@remnic/core 1.1.2 → 1.1.4

package/dist/chunk-32KD5IHZ.js

@@ -0,0 +1,245 @@
+import {
+  gatherConsoleState
+} from "./chunk-TYEOAFH3.js";
+
+// src/console/tui.ts
+var ANSI_CLEAR_HOME = "\x1B[2J\x1B[H";
+var ANSI_HIDE_CURSOR = "\x1B[?25l";
+var ANSI_SHOW_CURSOR = "\x1B[?25h";
+var FRAME_INNER_WIDTH = 70;
+var DEFAULT_REFRESH_INTERVAL_MS = 2e3;
+function runConsoleTui(orchestrator, options = {}) {
+  const refreshIntervalMs = Math.max(
+    50,
+    options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS
+  );
+  const output = options.output ?? process.stdout;
+  const now = options.now ?? (() => Date.now());
+  const installSigintHandler = options.installSigintHandler ?? true;
+  let stopped = false;
+  let inFlight = false;
+  let inFlightTickPromise = null;
+  let traceWritePending = false;
+  let traceFramesDropped = 0;
+  let resolveDone;
+  const done = new Promise((resolve) => {
+    resolveDone = resolve;
+  });
+  safeWrite(output, ANSI_HIDE_CURSOR);
+  const tick = async () => {
+    if (stopped || inFlight) return;
+    inFlight = true;
+    try {
+      let snapshot = null;
+      let renderError = null;
+      try {
+        snapshot = await gatherConsoleState(orchestrator);
+      } catch (err) {
+        renderError = describeError(err);
+      }
+      if (stopped) return;
+      let frame;
+      try {
+        frame = renderFrame({ snapshot, renderError, now });
+      } catch (err) {
+        frame = `remnic console: render failed: ${describeError(err)}
+`;
+      }
+      safeWrite(output, ANSI_CLEAR_HOME);
+      safeWrite(output, frame);
+      if (snapshot && options.traceRecorder && !traceWritePending) {
+        traceWritePending = true;
+        void options.traceRecorder.append(snapshot).catch(() => {
+        }).finally(() => {
+          traceWritePending = false;
+        });
+      } else if (snapshot && options.traceRecorder) {
+        traceFramesDropped += 1;
+      }
+    } finally {
+      inFlight = false;
+    }
+  };
+  const launchTick = () => {
+    const p = runTickSafely(tick);
+    inFlightTickPromise = p;
+    void p.then(() => {
+      if (inFlightTickPromise === p) {
+        inFlightTickPromise = null;
+      }
+    });
+  };
+  launchTick();
+  const handle = setInterval(launchTick, refreshIntervalMs);
+  const sigintHandler = () => {
+    stop();
+  };
+  if (installSigintHandler) {
+    process.on("SIGINT", sigintHandler);
+  }
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    clearInterval(handle);
+    if (installSigintHandler) {
+      try {
+        process.removeListener("SIGINT", sigintHandler);
+      } catch {
+      }
+    }
+    safeWrite(output, ANSI_SHOW_CURSOR);
+    void (async () => {
+      try {
+        const pendingTick = inFlightTickPromise;
+        if (pendingTick) {
+          await pendingTick;
+        }
+      } finally {
+        resolveDone();
+      }
+    })();
+  };
+  return {
+    stop,
+    done,
+    getDroppedTraceFrames: () => traceFramesDropped
+  };
+}
+function renderFrame(input) {
+  const ts = new Date(input.now()).toISOString();
+  const lines = [];
+  lines.push(renderHeader(ts));
+  for (const panel of renderPanels(input)) {
+    lines.push(panel);
+  }
+  lines.push(renderFooter());
+  return lines.join("\n") + "\n";
+}
+function renderHeader(ts) {
+  const title = " remnic console ";
+  const trailing = ` ${ts} `;
+  const fillerLen = Math.max(
+    1,
+    FRAME_INNER_WIDTH - title.length - trailing.length
+  );
+  const filler = "\u2550".repeat(fillerLen);
+  return `\u2554${title}${filler}${trailing}\u2557`;
+}
+function renderFooter() {
+  return `\u255A${"\u2550".repeat(FRAME_INNER_WIDTH)}\u255D`;
+}
+function renderPanels(input) {
+  const lines = [];
+  const snap = input.snapshot;
+  if (input.renderError !== null) {
+    lines.push(panelLine("Error", `refresh failed: ${input.renderError}`));
+    lines.push(panelLine("Buffer", "(unavailable)"));
+    lines.push(panelLine("Extraction", "(unavailable)"));
+    lines.push(panelLine("Dedup", "(unavailable)"));
+    lines.push(panelLine("Maintenance", "(unavailable)"));
+    lines.push(panelLine("QMD", "(unavailable)"));
+    return lines;
+  }
+  if (snap) {
+    lines.push(
+      panelLine(
+        "Buffer",
+        `turns=${snap.bufferState.turnsCount} bytes=${snap.bufferState.byteCount}`
+      )
+    );
+    const verdicts = snap.extractionQueue.recentVerdicts;
+    const accepts = verdicts.filter((v) => v.kind === "accept").length;
+    const rejects = verdicts.filter((v) => v.kind === "reject").length;
+    lines.push(
+      panelLine(
+        "Extraction",
+        `queue=${snap.extractionQueue.depth}  recent verdicts: accept(${accepts})/reject(${rejects})`
+      )
+    );
+    const dedupSummary = formatDedupSummary(snap.dedupRecent, input.now);
+    lines.push(panelLine("Dedup", dedupSummary));
+    const maintSummary = formatMaintenanceTail(snap.maintenanceLedgerTail);
+    lines.push(panelLine("Maintenance", maintSummary));
+    lines.push(panelLine("QMD", formatQmdSummary(snap)));
+  }
+  if (snap && snap.errors.length > 0) {
+    const head = snap.errors[0];
+    lines.push(panelLine("Errors", head ?? ""));
+  }
+  return lines;
+}
+function formatDedupSummary(decisions, now) {
+  if (decisions.length === 0) return "no recent decisions";
+  const last = decisions[decisions.length - 1];
+  if (!last) return "no recent decisions";
+  const ageMs = ageMsFromIso(last.ts, now);
+  const ageStr = ageMs === null ? "T-?" : `T-${Math.round(ageMs / 1e3)}s`;
+  const fp = last.fingerprint ? `hash=${last.fingerprint}` : "hash=?";
+  return `recent: ${fp} decision=${last.decision} (${ageStr})`;
+}
+function formatMaintenanceTail(events) {
+  if (events.length === 0) return "no events";
+  const last = events[events.length - 1];
+  if (!last) return "no events";
+  return `n=${events.length}  last: ${last.category} ${truncate(last.summary, 40)}`;
+}
+function formatQmdSummary(snap) {
+  const probe = snap.qmdProbe.available ? "ok" : "down";
+  const uptimeH = snap.daemon.uptimeMs / 36e5;
+  const uptimeStr = uptimeH < 1 ? `${Math.round(snap.daemon.uptimeMs / 1e3)}s` : `${uptimeH.toFixed(1)}h`;
+  const mode = snap.qmdProbe.daemonMode ? "daemon" : "cli";
+  return `probe=${probe}  mode=${mode}  uptime=${uptimeStr}`;
+}
+function panelLine(label, value) {
+  const LABEL_WIDTH = 13;
+  const labelCol = padRight(label, LABEL_WIDTH);
+  const remaining = FRAME_INNER_WIDTH - LABEL_WIDTH - 2;
+  const valueCol = padRight(truncate(value, remaining), remaining);
+  return `\u2551 ${labelCol}${valueCol} \u2551`;
+}
+function padRight(s, width) {
+  if (s.length >= width) return s;
+  return s + " ".repeat(width - s.length);
+}
+function truncate(s, max) {
+  if (max <= 0) return "";
+  if (s.length <= max) return s;
+  if (max <= 1) return s.slice(0, max);
+  return s.slice(0, max - 1) + "\u2026";
+}
+function ageMsFromIso(iso, now) {
+  const ms = Date.parse(iso);
+  if (!Number.isFinite(ms)) return null;
+  const delta = now() - ms;
+  return delta < 0 ? 0 : delta;
+}
+async function runTickSafely(tick) {
+  try {
+    await tick();
+  } catch {
+  }
+}
+function safeWrite(output, chunk) {
+  try {
+    output.write(chunk);
+  } catch {
+  }
+}
+function describeError(err) {
+  if (err instanceof Error) return err.message;
+  try {
+    return String(err);
+  } catch {
+    return "unknown error";
+  }
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
+}
+
+export {
+  runConsoleTui,
+  renderFrame,
+  stripAnsi
+};
+//# sourceMappingURL=chunk-32KD5IHZ.js.map

package/dist/chunk-32KD5IHZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/console/tui.ts"],"sourcesContent":["/**\n * Operator console TUI for issue #688 (PR 2/3).\n *\n * Renders a five-panel one-screen layout that periodically polls\n * `gatherConsoleState` and repaints the terminal. Deliberately uses\n * the minimal-deps \"clear + repaint\" approach (no curses / blessed /\n * ink) — we just emit ANSI control sequences directly to the output\n * stream. This keeps the surface portable and dependency-free.\n *\n * PR 1/3 (#721) shipped `gatherConsoleState` plus the CLI's\n * `--state-only` flag (one-shot JSON snapshot). PR 2/3 wires the\n * interactive surface. Trace replay (`--trace <session-id>`) is\n * deferred to PR 3/3.\n *\n * Design contract:\n *   - Read-only: never mutates orchestrator state.\n *   - Resilient: a thrown error in one refresh cycle must NOT crash\n *     the loop. Errors are surfaced inside the rendered frame.\n *   - Cleanly stoppable: `runConsoleTui` returns a `stop()` that\n *     clears the interval, restores the cursor, and resolves the\n *     pending exit promise. SIGINT triggers the same cleanup.\n *   - No external deps: only ANSI control sequences.\n */\n\nimport type { Writable } from \"node:stream\";\n\nimport {\n  gatherConsoleState,\n  type ConsoleStateOrchestratorLike,\n  type ConsoleStateSnapshot,\n} from \"./state.js\";\n\n/** ANSI: clear screen + move cursor to home (top-left). */\nconst ANSI_CLEAR_HOME = \"\\x1b[2J\\x1b[H\";\n/** ANSI: hide / show the cursor (we hide during the loop, restore on exit). */\nconst ANSI_HIDE_CURSOR = \"\\x1b[?25l\";\nconst ANSI_SHOW_CURSOR = \"\\x1b[?25h\";\n\n/** Total inner width of the rendered frame (between the box borders). */\nconst FRAME_INNER_WIDTH = 70;\n\n/** Default refresh interval in milliseconds. Chosen to match the spec. */\nconst DEFAULT_REFRESH_INTERVAL_MS = 2000;\n\nexport interface RunConsoleTuiOptions {\n  /** Polling interval in milliseconds. Defaults to 2000ms. */\n  refreshIntervalMs?: number;\n  /** Output stream. Defaults to `process.stdout`. */\n  output?: Writable;\n  /**\n   * Optional clock injection — primarily for tests so the rendered\n   * timestamp is deterministic. Defaults to `Date.now`.\n   */\n  now?: () => number;\n  /**\n   * If true, install a SIGINT handler that calls `stop()` and resolves\n   * the returned promise. Defaults to true. Tests typically pass false.\n   */\n  installSigintHandler?: boolean;\n  /**\n   * Optional trace recorder. When provided, every successfully\n   * gathered snapshot is appended to the recorder for later replay\n   * via `replayTrace`. Failed appends are surfaced through the\n   * recorder's `getLastError()` and never crash the loop (issue\n   * #688 PR 3/3).\n   */\n  traceRecorder?: {\n    append: (snapshot: ConsoleStateSnapshot) => Promise<void>;\n  };\n}\n\nexport interface RunConsoleTuiHandle {\n  /**\n   * Stop the refresh loop and restore the cursor. Returns immediately;\n   * callers should `await handle.done` to wait for any in-flight tick\n   * (and its trace append) to finish. Codex P2 (#732 round 4): without\n   * the in-flight await on the `done` path, a Ctrl-C that fires while\n   * a tick is past its `stopped` check could still call\n   * `traceRecorder.append` AFTER the CLI begins closing the recorder.\n   */\n  stop: () => void;\n  /**\n   * Resolves once `stop()` has been invoked, the interval is cleared,\n   * AND any in-flight tick (including its fire-and-forget trace\n   * append) has resolved. Callers that close a trace recorder after\n   * the TUI exits MUST await this promise before initiating close,\n   * otherwise the close path can race a still-running `append` call\n   * and surface phantom \"post-close\" appends to the recorder. Codex\n   * P2 (#732 round 4).\n   */\n  done: Promise<void>;\n  /**\n   * Number of trace frames that were dropped due to backpressure (i.e.\n   * the previous `traceRecorder.append()` had not yet resolved when\n   * the tick fired). Non-zero values indicate the trace recorder is\n   * falling behind — typically caused by a slow or network-backed\n   * filesystem. Codex P2 (PR #732 round 5): exposed so operators can\n   * detect recording lag via `--state-only` snapshots or future\n   * diagnostic surfaces.\n   */\n  getDroppedTraceFrames: () => number;\n}\n\n/**\n * Start the operator console TUI. Returns immediately with a handle\n * exposing `stop()` and a `done` promise that resolves once the loop\n * has been torn down. The caller can `await handle.done` to block\n * until the user (or a SIGINT) exits.\n */\nexport function runConsoleTui(\n  orchestrator: ConsoleStateOrchestratorLike,\n  options: RunConsoleTuiOptions = {},\n): RunConsoleTuiHandle {\n  const refreshIntervalMs = Math.max(\n    50,\n    options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS,\n  );\n  const output: Writable = options.output ?? process.stdout;\n  const now = options.now ?? (() => Date.now());\n  const installSigintHandler = options.installSigintHandler ?? true;\n\n  let stopped = false;\n  let inFlight = false;\n  // Codex P2 (PR #732 round 4): track the in-flight tick promise so\n  // `stop()` can await it before resolving `done`. Without this, a\n  // Ctrl-C that fires while a tick is past its `if (stopped) return`\n  // check can still execute `traceRecorder.append(snapshot)` AFTER\n  // `done` resolves and the CLI shutdown path begins closing the\n  // recorder. By awaiting the tick body, we ensure\n  // `recorder.append()` has at least been called (synchronously\n  // enqueueing the line onto the recorder's internal writeChain)\n  // before `done` resolves; the recorder's `close()` then drains\n  // that writeChain. Without the await, `close()` can begin draining\n  // while the tick is still about to call `append()`, producing a\n  // post-close append.\n  //\n  // We deliberately do NOT also await the resulting fire-and-forget\n  // trace promise. The append is fire-and-forget on purpose\n  // (backpressure: see comment further below); a wedged disk that\n  // stalls the append must not also stall shutdown. The recorder's\n  // own `close()` path (combined with `flushWithTimeout` in the CLI)\n  // is the right place to bound the disk-drain wait.\n  let inFlightTickPromise: Promise<void> | null = null;\n  // Codex P2 (PR #732): backpressure for trace recording. If the\n  // previous fire-and-forget `append()` has not resolved yet, we drop\n  // the current frame instead of enqueuing it onto the recorder's\n  // internal writeChain. Without this guard, a wedged filesystem\n  // would let memory grow unboundedly — every tick adds a JSON line\n  // to a serialized chain that never drains. Dropping is preferable\n  // to OOM; the operator can inspect `getLastError()` to learn that\n  // tracing fell behind.\n  let traceWritePending = false;\n  let traceFramesDropped = 0;\n  let resolveDone!: () => void;\n  const done = new Promise<void>((resolve) => {\n    resolveDone = resolve;\n  });\n\n  // Hide the cursor while the loop runs so the repaint doesn't flicker.\n  safeWrite(output, ANSI_HIDE_CURSOR);\n\n  const tick = async () => {\n    if (stopped || inFlight) return;\n    inFlight = true;\n    // Cursor Low: wrap the entire body in try/finally so a thrown\n    // `renderFrame` (or any other unexpected sync failure after the\n    // gatherConsoleState try/catch) still releases the `inFlight`\n    // latch. Without this guard, a single render-time exception\n    // permanently freezes the loop because every subsequent tick\n    // hits `if (inFlight) return`. Honors the file's design contract\n    // (\"a thrown error in one refresh cycle must NOT crash the loop\").\n    try {\n      let snapshot: ConsoleStateSnapshot | null = null;\n      let renderError: string | null = null;\n      try {\n        snapshot = await gatherConsoleState(orchestrator);\n      } catch (err) {\n        renderError = describeError(err);\n      }\n      if (stopped) return;\n      let frame: string;\n      try {\n        frame = renderFrame({ snapshot, renderError, now });\n      } catch (err) {\n        // If the renderer itself throws (e.g. an invalid clock\n        // injection produced `NaN`), fall back to a minimal error\n        // frame instead of letting the exception escape and reject\n        // the void-floated promise (which would also be unhandled).\n        frame = `remnic console: render failed: ${describeError(err)}\\n`;\n      }\n      safeWrite(output, ANSI_CLEAR_HOME);\n      safeWrite(output, frame);\n      // Codex P2: do NOT await trace writes inside the render tick.\n      // Awaiting holds `inFlight = true` for the duration of the disk\n      // write; on a slow / network-backed filesystem that stretches\n      // the visual refresh interval and skips ticks. Fire-and-forget\n      // preserves the paint cadence; errors are captured via\n      // `getLastError()`.\n      //\n      // Codex P2 (PR #732 follow-up): apply backpressure. If the\n      // previous append is still pending (writeChain not yet\n      // drained), drop this frame instead of queuing another line.\n      // Without this gate, a wedged FS lets the chain grow\n      // unboundedly — one JSON line per tick — until the process\n      // OOMs. Dropping is preferable; the operator can inspect\n      // `getLastError()` to see tracing fell behind.\n      if (snapshot && options.traceRecorder && !traceWritePending) {\n        traceWritePending = true;\n        void options.traceRecorder\n          .append(snapshot)\n          .catch(() => {\n            // already recorded in lastError; defense-in-depth.\n          })\n          .finally(() => {\n            traceWritePending = false;\n          });\n      } else if (snapshot && options.traceRecorder) {\n        traceFramesDropped += 1;\n      }\n    } finally {\n      inFlight = false;\n    }\n  };\n\n  // Kick off an immediate first paint, then schedule the interval.\n  // Codex P1: do NOT call `handle.unref()`. The CLI path keeps the\n  // process alive by `await`-ing `handle.done`, but a pending promise\n  // alone is not enough to keep Node.js running — the interval timer\n  // is the only ref'd handle that holds the event loop open between\n  // ticks. Unref'ing it caused `remnic console` to render once and\n  // exit immediately. Tests that don't want the process held open\n  // can call `handle.stop()` directly when they're done.\n  // Codex P2 (PR #732 round 4): wrap each tick launch so we hold a\n  // reference to the in-flight tick promise. `stop()` awaits this\n  // promise before resolving `done`, ensuring no late\n  // `traceRecorder.append` call races the CLI shutdown path that\n  // closes the recorder once `done` resolves.\n  const launchTick = (): void => {\n    const p = runTickSafely(tick);\n    inFlightTickPromise = p;\n    void p.then(() => {\n      if (inFlightTickPromise === p) {\n        inFlightTickPromise = null;\n      }\n    });\n  };\n  launchTick();\n  const handle = setInterval(launchTick, refreshIntervalMs);\n\n  const sigintHandler = () => {\n    stop();\n  };\n  if (installSigintHandler) {\n    process.on(\"SIGINT\", sigintHandler);\n  }\n\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    clearInterval(handle);\n    if (installSigintHandler) {\n      try {\n        process.removeListener(\"SIGINT\", sigintHandler);\n      } catch {\n        // ignore\n      }\n    }\n    safeWrite(output, ANSI_SHOW_CURSOR);\n    // Codex P2 (PR #732 round 4): wait for any in-flight tick before\n    // resolving `done`. Without this, a Ctrl-C that fires while a\n    // tick is past its `if (stopped) return` check can still execute\n    // `traceRecorder.append(snapshot)` AFTER `done` resolves and the\n    // CLI shutdown path begins closing the recorder, producing a\n    // phantom post-close append. By awaiting the tick body, we\n    // ensure `recorder.append()` has at least been *called*\n    // (synchronously enqueueing the line onto the recorder's\n    // writeChain) before `done` resolves; the recorder's `close()`\n    // then drains that writeChain.\n    //\n    // We do NOT also await the fire-and-forget trace append promise\n    // itself. A wedged disk that stalls the append must not also\n    // stall shutdown — the recorder's `close()` path (bounded by\n    // `flushWithTimeout` in the CLI) is the right place to bound\n    // the disk-drain wait.\n    void (async () => {\n      try {\n        const pendingTick = inFlightTickPromise;\n        if (pendingTick) {\n          await pendingTick;\n        }\n      } finally {\n        resolveDone();\n      }\n    })();\n  };\n\n  return {\n    stop,\n    done,\n    getDroppedTraceFrames: () => traceFramesDropped,\n  };\n}\n\ninterface RenderFrameInput {\n  snapshot: ConsoleStateSnapshot | null;\n  renderError: string | null;\n  now: () => number;\n}\n\n/**\n * Build the full rendered frame as a single string. Pure — exposed\n * for testing.\n */\nexport function renderFrame(input: RenderFrameInput): string {\n  const ts = new Date(input.now()).toISOString();\n  const lines: string[] = [];\n  lines.push(renderHeader(ts));\n  for (const panel of renderPanels(input)) {\n    lines.push(panel);\n  }\n  lines.push(renderFooter());\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\nfunction renderHeader(ts: string): string {\n  // ╔═ remnic console ════════════════════════════════ <ts> ═╗\n  const title = \" remnic console \";\n  const trailing = ` ${ts} `;\n  // 2 corner chars + title + ts + filler. Filler at minimum 1 char.\n  const fillerLen = Math.max(\n    1,\n    FRAME_INNER_WIDTH - title.length - trailing.length,\n  );\n  const filler = \"═\".repeat(fillerLen);\n  return `╔${title}${filler}${trailing}╗`;\n}\n\nfunction renderFooter(): string {\n  return `╚${\"═\".repeat(FRAME_INNER_WIDTH)}╝`;\n}\n\nfunction renderPanels(input: RenderFrameInput): string[] {\n  const lines: string[] = [];\n  const snap = input.snapshot;\n\n  if (input.renderError !== null) {\n    lines.push(panelLine(\"Error\", `refresh failed: ${input.renderError}`));\n    // Even on error we still print the section headers so the layout\n    // stays stable for the operator and tests can locate them.\n    lines.push(panelLine(\"Buffer\", \"(unavailable)\"));\n    lines.push(panelLine(\"Extraction\", \"(unavailable)\"));\n    lines.push(panelLine(\"Dedup\", \"(unavailable)\"));\n    lines.push(panelLine(\"Maintenance\", \"(unavailable)\"));\n    lines.push(panelLine(\"QMD\", \"(unavailable)\"));\n    return lines;\n  }\n\n  // Buffer panel.\n  if (snap) {\n    lines.push(\n      panelLine(\n        \"Buffer\",\n        `turns=${snap.bufferState.turnsCount} bytes=${snap.bufferState.byteCount}`,\n      ),\n    );\n\n    // Extraction panel.\n    const verdicts = snap.extractionQueue.recentVerdicts;\n    const accepts = verdicts.filter((v) => v.kind === \"accept\").length;\n    const rejects = verdicts.filter((v) => v.kind === \"reject\").length;\n    lines.push(\n      panelLine(\n        \"Extraction\",\n        `queue=${snap.extractionQueue.depth}  recent verdicts: accept(${accepts})/reject(${rejects})`,\n      ),\n    );\n\n    // Dedup panel.\n    const dedupSummary = formatDedupSummary(snap.dedupRecent, input.now);\n    lines.push(panelLine(\"Dedup\", dedupSummary));\n\n    // Maintenance panel.\n    const maintSummary = formatMaintenanceTail(snap.maintenanceLedgerTail);\n    lines.push(panelLine(\"Maintenance\", maintSummary));\n\n    // QMD panel.\n    lines.push(panelLine(\"QMD\", formatQmdSummary(snap)));\n  }\n\n  // Surface aggregator-level read errors (e.g. ledger I/O failures)\n  // without crashing the loop. These are not fatal — the snapshot is\n  // still partially usable.\n  if (snap && snap.errors.length > 0) {\n    const head = snap.errors[0];\n    lines.push(panelLine(\"Errors\", head ?? \"\"));\n  }\n\n  return lines;\n}\n\nfunction formatDedupSummary(\n  decisions: ConsoleStateSnapshot[\"dedupRecent\"],\n  now: () => number,\n): string {\n  if (decisions.length === 0) return \"no recent decisions\";\n  const last = decisions[decisions.length - 1];\n  if (!last) return \"no recent decisions\";\n  const ageMs = ageMsFromIso(last.ts, now);\n  const ageStr = ageMs === null ? \"T-?\" : `T-${Math.round(ageMs / 1000)}s`;\n  const fp = last.fingerprint ? `hash=${last.fingerprint}` : \"hash=?\";\n  return `recent: ${fp} decision=${last.decision} (${ageStr})`;\n}\n\nfunction formatMaintenanceTail(\n  events: ConsoleStateSnapshot[\"maintenanceLedgerTail\"],\n): string {\n  if (events.length === 0) return \"no events\";\n  const last = events[events.length - 1];\n  if (!last) return \"no events\";\n  // Show count + most-recent event line.\n  return `n=${events.length}  last: ${last.category} ${truncate(last.summary, 40)}`;\n}\n\nfunction formatQmdSummary(snap: ConsoleStateSnapshot): string {\n  const probe = snap.qmdProbe.available ? \"ok\" : \"down\";\n  const uptimeH = snap.daemon.uptimeMs / 3_600_000;\n  const uptimeStr = uptimeH < 1\n    ? `${Math.round(snap.daemon.uptimeMs / 1000)}s`\n    : `${uptimeH.toFixed(1)}h`;\n  const mode = snap.qmdProbe.daemonMode ? \"daemon\" : \"cli\";\n  return `probe=${probe}  mode=${mode}  uptime=${uptimeStr}`;\n}\n\nfunction panelLine(label: string, value: string): string {\n  // Layout: ║<space><label padded to LABEL_WIDTH><value padded to fill><space>║\n  // Cursor Medium: the closing ║ must be preceded by a trailing space\n  // so the rendered line width matches the header/footer borders.\n  // Without it, every panel line was 71 chars while the borders were\n  // 72, misaligning the right-hand box edge.\n  const LABEL_WIDTH = 13;\n  const labelCol = padRight(label, LABEL_WIDTH);\n  // Two spaces (leading + trailing) inside the box, consuming 2 cols.\n  const remaining = FRAME_INNER_WIDTH - LABEL_WIDTH - 2;\n  const valueCol = padRight(truncate(value, remaining), remaining);\n  return `║ ${labelCol}${valueCol} ║`;\n}\n\nfunction padRight(s: string, width: number): string {\n  if (s.length >= width) return s;\n  return s + \" \".repeat(width - s.length);\n}\n\nfunction truncate(s: string, max: number): string {\n  if (max <= 0) return \"\";\n  if (s.length <= max) return s;\n  if (max <= 1) return s.slice(0, max);\n  return s.slice(0, max - 1) + \"…\";\n}\n\nfunction ageMsFromIso(iso: string, now: () => number): number | null {\n  const ms = Date.parse(iso);\n  if (!Number.isFinite(ms)) return null;\n  const delta = now() - ms;\n  return delta < 0 ? 0 : delta;\n}\n\n/**\n * Run an async tick function and swallow any rejection so the floated\n * `void runTickSafely(tick)` call never produces an unhandled-rejection\n * crash (which Node ≥15 escalates to a process exit). The tick body\n * itself already wraps everything in try/finally, but this is the\n * outermost belt-and-suspenders guard.\n */\nasync function runTickSafely(tick: () => Promise<void>): Promise<void> {\n  try {\n    await tick();\n  } catch {\n    // Any error has already been (or will be) surfaced inside the\n    // rendered frame; never let it escape the timer callback.\n  }\n}\n\nfunction safeWrite(output: Writable, chunk: string): void {\n  try {\n    output.write(chunk);\n  } catch {\n    // Writing to a closed / broken stream is non-fatal for the TUI;\n    // the next tick will retry.\n  }\n}\n\nfunction describeError(err: unknown): string {\n  if (err instanceof Error) return err.message;\n  try {\n    return String(err);\n  } catch {\n    return \"unknown error\";\n  }\n}\n\n/**\n * Strip ANSI escape sequences from a string. Exposed for tests so the\n * rendered frame can be asserted against plain text.\n */\nexport function stripAnsi(s: string): string {\n  // eslint-disable-next-line no-control-regex\n  return s.replace(/\\x1b\\[[0-9;?]*[A-Za-z]/g, \"\");\n}\n"],"mappings":";;;;;AAiCA,IAAM,kBAAkB;AAExB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAGzB,IAAM,oBAAoB;AAG1B,IAAM,8BAA8B;AAmE7B,SAAS,cACd,cACA,UAAgC,CAAC,GACZ;AACrB,QAAM,oBAAoB,KAAK;AAAA,IAC7B;AAAA,IACA,QAAQ,qBAAqB;AAAA,EAC/B;AACA,QAAM,SAAmB,QAAQ,UAAU,QAAQ;AACnD,QAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAC3C,QAAM,uBAAuB,QAAQ,wBAAwB;AAE7D,MAAI,UAAU;AACd,MAAI,WAAW;AAoBf,MAAI,sBAA4C;AAShD,MAAI,oBAAoB;AACxB,MAAI,qBAAqB;AACzB,MAAI;AACJ,QAAM,OAAO,IAAI,QAAc,CAAC,YAAY;AAC1C,kBAAc;AAAA,EAChB,CAAC;AAGD,YAAU,QAAQ,gBAAgB;AAElC,QAAM,OAAO,YAAY;AACvB,QAAI,WAAW,SAAU;AACzB,eAAW;AAQX,QAAI;AACF,UAAI,WAAwC;AAC5C,UAAI,cAA6B;AACjC,UAAI;AACF,mBAAW,MAAM,mBAAmB,YAAY;AAAA,MAClD,SAAS,KAAK;AACZ,sBAAc,cAAc,GAAG;AAAA,MACjC;AACA,UAAI,QAAS;AACb,UAAI;AACJ,UAAI;AACF,gBAAQ,YAAY,EAAE,UAAU,aAAa,IAAI,CAAC;AAAA,MACpD,SAAS,KAAK;AAKZ,gBAAQ,kCAAkC,cAAc,GAAG,CAAC;AAAA;AAAA,MAC9D;AACA,gBAAU,QAAQ,eAAe;AACjC,gBAAU,QAAQ,KAAK;AAevB,UAAI,YAAY,QAAQ,iBAAiB,CAAC,mBAAmB;AAC3D,4BAAoB;AACpB,aAAK,QAAQ,cACV,OAAO,QAAQ,EACf,MAAM,MAAM;AAAA,QAEb,CAAC,EACA,QAAQ,MAAM;AACb,8BAAoB;AAAA,QACtB,CAAC;AAAA,MACL,WAAW,YAAY,QAAQ,eAAe;AAC5C,8BAAsB;AAAA,MACxB;AAAA,IACF,UAAE;AACA,iBAAW;AAAA,IACb;AAAA,EACF;AAeA,QAAM,aAAa,MAAY;AAC7B,UAAM,IAAI,cAAc,IAAI;AAC5B,0BAAsB;AACtB,SAAK,EAAE,KAAK,MAAM;AAChB,UAAI,wBAAwB,GAAG;AAC7B,8BAAsB;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH;AACA,aAAW;AACX,QAAM,SAAS,YAAY,YAAY,iBAAiB;AAExD,QAAM,gBAAgB,MAAM;AAC1B,SAAK;AAAA,EACP;AACA,MAAI,sBAAsB;AACxB,YAAQ,GAAG,UAAU,aAAa;AAAA,EACpC;AAEA,QAAM,OAAO,MAAM;AACjB,QAAI,QAAS;AACb,cAAU;AACV,kBAAc,MAAM;AACpB,QAAI,sBAAsB;AACxB,UAAI;AACF,gBAAQ,eAAe,UAAU,aAAa;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AACA,cAAU,QAAQ,gBAAgB;AAiBlC,UAAM,YAAY;AAChB,UAAI;AACF,cAAM,cAAc;AACpB,YAAI,aAAa;AACf,gBAAM;AAAA,QACR;AAAA,MACF,UAAE;AACA,oBAAY;AAAA,MACd;AAAA,IACF,GAAG;AAAA,EACL;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uBAAuB,MAAM;AAAA,EAC/B;AACF;AAYO,SAAS,YAAY,OAAiC;AAC3D,QAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC,EAAE,YAAY;AAC7C,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,aAAa,EAAE,CAAC;AAC3B,aAAW,SAAS,aAAa,KAAK,GAAG;AACvC,UAAM,KAAK,KAAK;AAAA,EAClB;AACA,QAAM,KAAK,aAAa,CAAC;AACzB,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEA,SAAS,aAAa,IAAoB;AAExC,QAAM,QAAQ;AACd,QAAM,WAAW,IAAI,EAAE;AAEvB,QAAM,YAAY,KAAK;AAAA,IACrB;AAAA,IACA,oBAAoB,MAAM,SAAS,SAAS;AAAA,EAC9C;AACA,QAAM,SAAS,SAAI,OAAO,SAAS;AACnC,SAAO,SAAI,KAAK,GAAG,MAAM,GAAG,QAAQ;AACtC;AAEA,SAAS,eAAuB;AAC9B,SAAO,SAAI,SAAI,OAAO,iBAAiB,CAAC;AAC1C;AAEA,SAAS,aAAa,OAAmC;AACvD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,MAAM;AAEnB,MAAI,MAAM,gBAAgB,MAAM;AAC9B,UAAM,KAAK,UAAU,SAAS,mBAAmB,MAAM,WAAW,EAAE,CAAC;AAGrE,UAAM,KAAK,UAAU,UAAU,eAAe,CAAC;AAC/C,UAAM,KAAK,UAAU,cAAc,eAAe,CAAC;AACnD,UAAM,KAAK,UAAU,SAAS,eAAe,CAAC;AAC9C,UAAM,KAAK,UAAU,eAAe,eAAe,CAAC;AACpD,UAAM,KAAK,UAAU,OAAO,eAAe,CAAC;AAC5C,WAAO;AAAA,EACT;AAGA,MAAI,MAAM;AACR,UAAM;AAAA,MACJ;AAAA,QACE;AAAA,QACA,SAAS,KAAK,YAAY,UAAU,UAAU,KAAK,YAAY,SAAS;AAAA,MAC1E;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,gBAAgB;AACtC,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE;AAC5D,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE;AAC5D,UAAM;AAAA,MACJ;AAAA,QACE;AAAA,QACA,SAAS,KAAK,gBAAgB,KAAK,6BAA6B,OAAO,YAAY,OAAO;AAAA,MAC5F;AAAA,IACF;AAGA,UAAM,eAAe,mBAAmB,KAAK,aAAa,MAAM,GAAG;AACnE,UAAM,KAAK,UAAU,SAAS,YAAY,CAAC;AAG3C,UAAM,eAAe,sBAAsB,KAAK,qBAAqB;AACrE,UAAM,KAAK,UAAU,eAAe,YAAY,CAAC;AAGjD,UAAM,KAAK,UAAU,OAAO,iBAAiB,IAAI,CAAC,CAAC;AAAA,EACrD;AAKA,MAAI,QAAQ,KAAK,OAAO,SAAS,GAAG;AAClC,UAAM,OAAO,KAAK,OAAO,CAAC;AAC1B,UAAM,KAAK,UAAU,UAAU,QAAQ,EAAE,CAAC;AAAA,EAC5C;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,WACA,KACQ;AACR,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,OAAO,UAAU,UAAU,SAAS,CAAC;AAC3C,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,aAAa,KAAK,IAAI,GAAG;AACvC,QAAM,SAAS,UAAU,OAAO,QAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI,CAAC;AACrE,QAAM,KAAK,KAAK,cAAc,QAAQ,KAAK,WAAW,KAAK;AAC3D,SAAO,WAAW,EAAE,aAAa,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,SAAS,sBACP,QACQ;AACR,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,OAAO,OAAO,OAAO,SAAS,CAAC;AACrC,MAAI,CAAC,KAAM,QAAO;AAElB,SAAO,KAAK,OAAO,MAAM,WAAW,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;AACjF;AAEA,SAAS,iBAAiB,MAAoC;AAC5D,QAAM,QAAQ,KAAK,SAAS,YAAY,OAAO;AAC/C,QAAM,UAAU,KAAK,OAAO,WAAW;AACvC,QAAM,YAAY,UAAU,IACxB,GAAG,KAAK,MAAM,KAAK,OAAO,WAAW,GAAI,CAAC,MAC1C,GAAG,QAAQ,QAAQ,CAAC,CAAC;AACzB,QAAM,OAAO,KAAK,SAAS,aAAa,WAAW;AACnD,SAAO,SAAS,KAAK,UAAU,IAAI,YAAY,SAAS;AAC1D;AAEA,SAAS,UAAU,OAAe,OAAuB;AAMvD,QAAM,cAAc;AACpB,QAAM,WAAW,SAAS,OAAO,WAAW;AAE5C,QAAM,YAAY,oBAAoB,cAAc;AACpD,QAAM,WAAW,SAAS,SAAS,OAAO,SAAS,GAAG,SAAS;AAC/D,SAAO,UAAK,QAAQ,GAAG,QAAQ;AACjC;AAEA,SAAS,SAAS,GAAW,OAAuB;AAClD,MAAI,EAAE,UAAU,MAAO,QAAO;AAC9B,SAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,MAAM;AACxC;AAEA,SAAS,SAAS,GAAW,KAAqB;AAChD,MAAI,OAAO,EAAG,QAAO;AACrB,MAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,MAAI,OAAO,EAAG,QAAO,EAAE,MAAM,GAAG,GAAG;AACnC,SAAO,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI;AAC/B;AAEA,SAAS,aAAa,KAAa,KAAkC;AACnE,QAAM,KAAK,KAAK,MAAM,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,QAAM,QAAQ,IAAI,IAAI;AACtB,SAAO,QAAQ,IAAI,IAAI;AACzB;AASA,eAAe,cAAc,MAA0C;AACrE,MAAI;AACF,UAAM,KAAK;AAAA,EACb,QAAQ;AAAA,EAGR;AACF;AAEA,SAAS,UAAU,QAAkB,OAAqB;AACxD,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,QAAQ;AAAA,EAGR;AACF;AAEA,SAAS,cAAc,KAAsB;AAC3C,MAAI,eAAe,MAAO,QAAO,IAAI;AACrC,MAAI;AACF,WAAO,OAAO,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,UAAU,GAAmB;AAE3C,SAAO,EAAE,QAAQ,2BAA2B,EAAE;AAChD;","names":[]}

package/dist/chunk-3KIS4VGT.js

@@ -0,0 +1,228 @@
+import {
+  createVersion
+} from "./chunk-FAAFWE4G.js";
+import {
+  assertIsDirectoryNotSymlink,
+  assertRealpathInsideRoot,
+  fromPosixRelPath,
+  isPathInsideRoot,
+  sha256String
+} from "./chunk-457A4P3L.js";
+import {
+  parseExportBundle
+} from "./chunk-OA3L7BFR.js";
+import {
+  decryptCapsuleFileInMemory,
+  isEncryptedCapsuleFile
+} from "./chunk-KNKUID7G.js";
+
+// src/transfer/capsule-import.ts
+import { lstat, mkdir, readFile, realpath, stat, writeFile } from "fs/promises";
+import path from "path";
+import { createHash, randomUUID } from "crypto";
+import { gunzipSync } from "zlib";
+async function importCapsule(opts) {
+  const archiveAbs = path.resolve(opts.archivePath);
+  const rootAbs = path.resolve(opts.root);
+  await assertIsDirectoryNotSymlink(rootAbs, "importCapsule", "root");
+  const mode = opts.mode ?? "skip";
+  if (mode !== "skip" && mode !== "overwrite" && mode !== "fork") {
+    throw new Error(
+      `importCapsule: unknown mode ${JSON.stringify(mode)}; expected "skip", "overwrite", or "fork"`
+    );
+  }
+  const encrypted = await isEncryptedCapsuleFile(archiveAbs);
+  let raw;
+  if (encrypted) {
+    if (!opts.memoryDir) {
+      throw new Error(
+        `importCapsule: archive is encrypted but 'memoryDir' was not provided. Pass the memory directory so the secure-store key can be retrieved, or run \`remnic secure-store unlock\` before importing.`
+      );
+    }
+    raw = await decryptCapsuleFileInMemory(archiveAbs, opts.memoryDir);
+  } else {
+    raw = await readFile(archiveAbs);
+  }
+  const json = gunzipSync(raw).toString("utf-8");
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(json);
+  } catch (cause) {
+    throw new Error(
+      `importCapsule: archive is not valid JSON after gunzip: ${archiveAbs}`,
+      { cause }
+    );
+  }
+  const parsed = parseExportBundle(parsedJson);
+  if (parsed.capsuleVersion !== 2) {
+    throw new Error(
+      "importCapsule: archive is V1; only V2 capsule archives are supported"
+    );
+  }
+  const bundle = parsed.bundle;
+  const manifest = bundle.manifest;
+  const capsule = manifest.capsule;
+  const manifestIndex = /* @__PURE__ */ new Map();
+  for (const f of manifest.files) {
+    manifestIndex.set(f.path, f);
+  }
+  if (manifestIndex.size !== manifest.files.length) {
+    throw new Error(
+      "importCapsule: manifest contains duplicate file paths"
+    );
+  }
+  const recordPaths = /* @__PURE__ */ new Set();
+  for (const rec of bundle.records) {
+    if (recordPaths.has(rec.path)) {
+      throw new Error(
+        `importCapsule: bundle contains duplicate record path: ${rec.path}`
+      );
+    }
+    recordPaths.add(rec.path);
+  }
+  const rootReal = await realpath(rootAbs).catch(() => rootAbs);
+  const seenTargetPaths = /* @__PURE__ */ new Map();
+  for (const rec of bundle.records) {
+    const entry = manifestIndex.get(rec.path);
+    if (!entry) {
+      throw new Error(
+        `importCapsule: archive checksum mismatch (record without manifest entry: ${rec.path})`
+      );
+    }
+    const { sha256, bytes } = sha256String(rec.content);
+    if (sha256 !== entry.sha256 || bytes !== entry.bytes) {
+      throw new Error(
+        `importCapsule: archive checksum mismatch for ${rec.path}: expected sha256=${entry.sha256} bytes=${entry.bytes}, got sha256=${sha256} bytes=${bytes}`
+      );
+    }
+    if (rec.path.includes("\\")) {
+      throw new Error(
+        `importCapsule: record path contains backslash separators (Windows-style paths are not allowed): ${rec.path}`
+      );
+    }
+    const posixNormalized = path.posix.normalize(rec.path);
+    if (rec.path.startsWith("/") || rec.path.split("/").some((seg) => seg === "..") || posixNormalized.startsWith("..") || posixNormalized.startsWith("/")) {
+      throw new Error(
+        `importCapsule: record path escapes target root: ${rec.path}`
+      );
+    }
+    const targetRel = computeTargetPath(rec.path, mode, capsule.id);
+    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));
+    if (!isPathInsideRoot(rootReal, targetAbs)) {
+      throw new Error(
+        `importCapsule: record path escapes target root: ${rec.path}`
+      );
+    }
+    await assertRealpathInsideRoot(rootReal, targetAbs, rec.path, "importCapsule");
+    const targetLstat = await lstat(targetAbs).catch(() => null);
+    if (targetLstat !== null && targetLstat.isSymbolicLink()) {
+      throw new Error(
+        `importCapsule: record target is a symlink and cannot be written to safely: ${rec.path}`
+      );
+    }
+    const dedupKey = targetAbs.toLowerCase();
+    const firstSourcePath = seenTargetPaths.get(dedupKey);
+    if (firstSourcePath !== void 0) {
+      throw new Error(
+        `importCapsule: manifest contains two entries that resolve to the same target path: "${firstSourcePath}" and "${rec.path}" both map to "${targetRel}"`
+      );
+    }
+    seenTargetPaths.set(dedupKey, rec.path);
+  }
+  for (const f of manifest.files) {
+    if (!recordPaths.has(f.path)) {
+      throw new Error(
+        `importCapsule: archive checksum mismatch (manifest entry without record: ${f.path})`
+      );
+    }
+  }
+  const imported = [];
+  const skipped = [];
+  const sortedRecords = [...bundle.records].sort(
+    (a, b) => a.path.localeCompare(b.path)
+  );
+  for (const rec of sortedRecords) {
+    const targetRel = computeTargetPath(rec.path, mode, capsule.id);
+    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));
+    const exists = await fileExistsAt(targetAbs);
+    if ((mode === "skip" || mode === "fork") && exists) {
+      skipped.push({ path: rec.path, reason: "exists" });
+      continue;
+    }
+    let snapshotted = false;
+    if (mode === "overwrite" && exists) {
+      if (opts.versioning && opts.versioning.enabled) {
+        const prior = await readFile(targetAbs, "utf-8").catch(() => "");
+        await createVersion(
+          targetAbs,
+          prior,
+          "manual",
+          opts.versioning,
+          opts.log,
+          `capsule-import: ${capsule.id}`,
+          rootReal
+        );
+        snapshotted = true;
+      }
+    }
+    let contentToWrite = rec.content;
+    let rewroteId = false;
+    if (mode === "fork") {
+      const forked = rewriteFrontmatterIdForFork(rec.content, capsule.id, opts.now);
+      contentToWrite = forked.content;
+      rewroteId = forked.rewrote;
+    }
+    await mkdir(path.dirname(targetAbs), { recursive: true });
+    await writeFile(targetAbs, contentToWrite, "utf-8");
+    imported.push({
+      sourcePath: rec.path,
+      targetPath: targetRel,
+      snapshotted,
+      rewroteId
+    });
+  }
+  skipped.sort((a, b) => a.path.localeCompare(b.path));
+  return { imported, skipped, manifest };
+}
+function computeTargetPath(sourcePosix, mode, capsuleId) {
+  if (mode === "fork") return `forks/${capsuleId}/${sourcePosix}`;
+  return sourcePosix;
+}
+async function fileExistsAt(absPath) {
+  const st = await stat(absPath).catch(() => null);
+  return st !== null && st.isFile();
+}
+function rewriteFrontmatterIdForFork(content, capsuleId, now) {
+  const crlfMatch = /^---(\r\n|\r|\n)/.exec(content);
+  const eol = crlfMatch ? crlfMatch[1] : "\n";
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---(\r?\n|$)/.exec(content);
+  if (!fmMatch) return { content, rewrote: false };
+  const fmBody = fmMatch[1];
+  const fmTrailer = fmMatch[2];
+  const fmStart = fmMatch.index;
+  const fmEnd = fmStart + fmMatch[0].length;
+  const idLineRe = /^id:[ \t]*([^\r\n]*)$/m;
+  const idMatch = idLineRe.exec(fmBody);
+  if (!idMatch) return { content, rewrote: false };
+  const newId = mintForkId(capsuleId, idMatch[1]?.trim() ?? "", now);
+  const replacedBody = fmBody.replace(idLineRe, `id: ${newId}`);
+  const prefix = content.slice(0, fmStart);
+  const tail = content.slice(fmEnd);
+  const rebuilt = `${prefix}---${eol}${replacedBody}${eol}---${fmTrailer}${tail}`;
+  return { content: rebuilt, rewrote: true };
+}
+function mintForkId(capsuleId, originalId, now) {
+  const base = originalId.length > 0 ? originalId : "fork";
+  if (now === void 0) {
+    const suffix2 = randomUUID().slice(0, 8);
+    return `${base}-fork-${capsuleId}-${suffix2}`;
+  }
+  const payload = JSON.stringify({ c: capsuleId, i: originalId, n: now });
+  const suffix = createHash("sha256").update(payload, "utf-8").digest("hex").slice(0, 8);
+  return `${base}-fork-${capsuleId}-${suffix}`;
+}
+
+export {
+  importCapsule
+};
+//# sourceMappingURL=chunk-3KIS4VGT.js.map

package/dist/chunk-3KIS4VGT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/transfer/capsule-import.ts"],"sourcesContent":["import { lstat, mkdir, readFile, realpath, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { gunzipSync } from \"node:zlib\";\nimport {\n  createVersion,\n  type VersioningConfig,\n  type VersioningLogger,\n} from \"../page-versioning.js\";\nimport {\n  assertIsDirectoryNotSymlink,\n  assertRealpathInsideRoot,\n  fromPosixRelPath,\n  isPathInsideRoot,\n  sha256String,\n} from \"./fs-utils.js\";\nimport {\n  parseExportBundle,\n  type CapsuleBlock,\n  type ExportManifestV2,\n  type ExportMemoryRecordV1,\n} from \"./types.js\";\nimport { isEncryptedCapsuleFile, decryptCapsuleFileInMemory } from \"./capsule-crypto.js\";\n\n/**\n * Conflict-resolution mode for {@link importCapsule}. Inverse of the\n * `mode` selector in PR 4/6's CLI surface.\n *\n *  - `\"skip\"` (default) — when a target file already exists at the same\n *    relative path, leave it untouched. The corresponding record is reported\n *    via {@link ImportCapsuleResult.skipped}.\n *  - `\"overwrite\"` — when a target file exists, snapshot the prior content\n *    via {@link createVersion} (gotcha #54: write-before-delete; gotcha #25:\n *    don't destroy old state until new state is confirmed), then write the\n *    incoming content. The snapshot's `note` includes the source capsule id.\n *  - `\"fork\"` — never overwrite. Every record is rebased under\n *    `forks/<capsule-id>/<original-path>` and any YAML-frontmatter `id:`\n *    field is rewritten to a new fork-scoped value. The original tree is\n *    not touched.\n *\n * The mode is selected once per call and applied uniformly to every record\n * in the bundle. Mixed-mode imports are not supported by design — that\n * would let a single corrupted manifest silently land partial state.\n */\nexport type ImportCapsuleMode = \"skip\" | \"overwrite\" | \"fork\";\n\n/**\n * Options accepted by {@link importCapsule}.\n *\n * `archivePath` — absolute or cwd-relative path to a `.capsule.json.gz`\n * archive produced by `exportCapsule`. The archive must contain a V2\n * bundle (`schemaVersion: 2`); V1 archives are rejected.\n *\n * `root` — absolute or cwd-relative path to the memory directory that\n * will receive the records. Must be an existing directory.\n *\n * `mode` — see {@link ImportCapsuleMode}. Defaults to `\"skip\"`.\n *\n * `versioning` — optional page-versioning config used by `mode: \"overwrite\"`\n * to snapshot prior content before replacing it. Snapshots are skipped when\n * not provided or when `enabled === false`. Tests pass an enabled config\n * to assert snapshot creation; production callers thread the\n * orchestrator's resolved versioning config.\n *\n * `log` — optional logger forwarded to {@link createVersion}.\n *\n * `now` — optional clock override (ms epoch) used to derive deterministic\n * fork ids in tests. Production callers omit this.\n */\nexport interface ImportCapsuleOptions {\n  archivePath: string;\n  root: string;\n  mode?: ImportCapsuleMode;\n  versioning?: VersioningConfig;\n  log?: VersioningLogger;\n  now?: number;\n  /**\n   * Memory directory whose secure-store keyring is used when the archive is\n   * encrypted. Required when `archivePath` ends with `.enc` or when the file\n   * starts with the REMNIC-ENC magic header. If `memoryDir` is omitted and the\n   * archive turns out to be encrypted, `importCapsule` throws a clear error\n   * rather than silently failing.\n   *\n   * When provided and the archive is NOT encrypted, the value is ignored.\n   */\n  memoryDir?: string;\n}\n\nexport interface ImportCapsuleSkippedRecord {\n  /** Original record path (capsule-relative, posix). */\n  path: string;\n  /**\n   * Why this record was not written.\n   *\n   * `\"exists\"` — the target path already existed and the mode was `\"skip\"`,\n   * OR the computed fork path already existed in fork mode.\n   *\n   * `\"checksum_mismatch\"` is intentionally absent: a checksum failure aborts\n   * the import entirely (fail-closed) rather than skipping the offending\n   * record, so no `ImportCapsuleSkippedRecord` is ever produced for it.\n   */\n  reason: \"exists\";\n}\n\nexport interface ImportCapsuleImportedRecord {\n  /** Capsule-relative posix path the record carried. */\n  sourcePath: string;\n  /** Memory-dir-relative posix path the file was written to. */\n  targetPath: string;\n  /** Whether a prior version snapshot was taken (overwrite-mode only). */\n  snapshotted: boolean;\n  /** Whether the frontmatter `id:` field was rewritten (fork-mode only). */\n  rewroteId: boolean;\n}\n\nexport interface ImportCapsuleResult {\n  /** Records that landed on disk. */\n  imported: ImportCapsuleImportedRecord[];\n  /** Records that were not written. */\n  skipped: ImportCapsuleSkippedRecord[];\n  /** The manifest decoded from the archive. */\n  manifest: ExportManifestV2;\n}\n\n/**\n * Pure async function that imports a capsule archive into a memory\n * directory. Inverse of {@link import(\"./capsule-export.js\").exportCapsule}.\n *\n * Sequence:\n *   1. Read + gunzip + JSON.parse the archive.\n *   2. Validate the bundle through `parseExportBundle` (V1 rejected).\n *   3. Verify each record's content sha256 against the manifest entry.\n *      Any mismatch aborts the import BEFORE any file is written —\n *      partial-write recovery would require a full rollback we cannot\n *      offer cheaply, so we fail closed (gotcha #25).\n *   4. Apply the selected {@link ImportCapsuleMode} to every record.\n *\n * Determinism guarantees:\n *  - Imported records are returned sorted by `sourcePath`.\n *  - Skipped records are returned sorted by `path`.\n *  - Fork-mode rebases under a stable `forks/<capsule-id>/` prefix so\n *    repeated fork imports of the same capsule shape land in predictable\n *    locations (subsequent fork imports still skip-on-exist because the\n *    target tree is computed from the source path).\n */\nexport async function importCapsule(\n  opts: ImportCapsuleOptions,\n): Promise<ImportCapsuleResult> {\n  const archiveAbs = path.resolve(opts.archivePath);\n  const rootAbs = path.resolve(opts.root);\n  await assertIsDirectoryNotSymlink(rootAbs, \"importCapsule\", \"root\");\n\n  const mode: ImportCapsuleMode = opts.mode ?? \"skip\";\n  // Reject unknown mode values up-front (rule 51). TypeScript callers get a\n  // compile-time check via the union type; JS/CLI callers get a runtime error\n  // here before any write begins — not a silent destructive fallback.\n  if (mode !== \"skip\" && mode !== \"overwrite\" && mode !== \"fork\") {\n    throw new Error(\n      `importCapsule: unknown mode ${JSON.stringify(mode)}; expected \"skip\", \"overwrite\", or \"fork\"`,\n    );\n  }\n\n  // Auto-detect encrypted archives. If the file ends with `.enc` or starts\n  // with the REMNIC-ENC magic header, decrypt it first before gunzip+parse.\n  // Rule 48: default is \"not encrypted\"; we only attempt decryption when the\n  // header is definitively present, never on ambiguous content.\n  const encrypted = await isEncryptedCapsuleFile(archiveAbs);\n  let raw: Buffer;\n  if (encrypted) {\n    if (!opts.memoryDir) {\n      throw new Error(\n        `importCapsule: archive is encrypted but 'memoryDir' was not provided. ` +\n          `Pass the memory directory so the secure-store key can be retrieved, ` +\n          `or run \\`remnic secure-store unlock\\` before importing.`,\n      );\n    }\n    raw = await decryptCapsuleFileInMemory(archiveAbs, opts.memoryDir);\n  } else {\n    raw = await readFile(archiveAbs);\n  }\n  const json = gunzipSync(raw).toString(\"utf-8\");\n  let parsedJson: unknown;\n  try {\n    parsedJson = JSON.parse(json);\n  } catch (cause) {\n    throw new Error(\n      `importCapsule: archive is not valid JSON after gunzip: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  const parsed = parseExportBundle(parsedJson);\n  if (parsed.capsuleVersion !== 2) {\n    // PR 1/6 ships a V1 reader; capsule import is V2-only by design. A V1\n    // bundle does not carry a capsule block, so fork-mode (which depends on\n    // `capsule.id` for the rebase prefix) cannot work. Reject up-front per\n    // gotcha #51 instead of silently routing to a different code path.\n    throw new Error(\n      \"importCapsule: archive is V1; only V2 capsule archives are supported\",\n    );\n  }\n  const bundle = parsed.bundle as { manifest: ExportManifestV2; records: ExportMemoryRecordV1[] };\n  const manifest = bundle.manifest;\n  const capsule = manifest.capsule;\n\n  // Build a path → manifest-entry index for O(1) checksum lookup. The\n  // manifest is the source of truth; records-without-manifest-entries and\n  // manifest-entries-without-records are both treated as corruption.\n  const manifestIndex = new Map<string, ExportManifestV2[\"files\"][number]>();\n  for (const f of manifest.files) {\n    manifestIndex.set(f.path, f);\n  }\n  if (manifestIndex.size !== manifest.files.length) {\n    throw new Error(\n      \"importCapsule: manifest contains duplicate file paths\",\n    );\n  }\n  const recordPaths = new Set<string>();\n  for (const rec of bundle.records) {\n    if (recordPaths.has(rec.path)) {\n      throw new Error(\n        `importCapsule: bundle contains duplicate record path: ${rec.path}`,\n      );\n    }\n    recordPaths.add(rec.path);\n  }\n\n  // Phase 1: verify every record matches its manifest entry AND validate all\n  // target paths before any filesystem mutation.  We do both in a single pass\n  // so a corrupted or malicious archive cannot leave the memory dir partially\n  // written (fail-closed per gotcha #25).\n  //\n  // The real root is resolved once via realpath so the subsequent per-record\n  // inside-root checks are symlink-aware: a record path like `facts/a.md`\n  // cannot write outside the intended sandbox via a symlinked subdirectory\n  // (Codex P1 feedback).  If realpath fails (root does not exist) the earlier\n  // assertIsDirectoryNotSymlink call already threw, so this should always succeed.\n  const rootReal = await realpath(rootAbs).catch(() => rootAbs);\n\n  // Tracks normalized, case-folded target paths seen so far in phase 1.  Maps\n  // targetAbs.toLowerCase() → first source path so the collision error can name\n  // both offending entries.  Two manifest entries whose computed target paths\n  // normalize to the same absolute path (e.g. `subdir/file.md` and\n  // `subdir/./file.md`, or differing case on case-insensitive filesystems such\n  // as macOS and Windows) would both try to write the same inode — the second\n  // would silently overwrite the first.  We reject the import up-front before\n  // any write (Codex P2 thread on PR #741, line 283).\n  const seenTargetPaths = new Map<string, string>();\n\n  for (const rec of bundle.records) {\n    // Checksum validation.\n    const entry = manifestIndex.get(rec.path);\n    if (!entry) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch (record without manifest entry: ${rec.path})`,\n      );\n    }\n    const { sha256, bytes } = sha256String(rec.content);\n    if (sha256 !== entry.sha256 || bytes !== entry.bytes) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch for ${rec.path}: ` +\n          `expected sha256=${entry.sha256} bytes=${entry.bytes}, ` +\n          `got sha256=${sha256} bytes=${bytes}`,\n      );\n    }\n\n    // Source path validation: reject any record whose posix source path\n    // contains a `..` segment, an absolute prefix, or any component that would\n    // let fork-mode bypass its isolation invariant.  This check runs before\n    // `computeTargetPath` so that fork mode's `forks/<id>/` rebase cannot be\n    // bypassed by a path like `../../profile.md` (which `path.join` would\n    // silently collapse, landing the file inside root but outside the fork\n    // prefix — Cursor medium thread #741).  Rejecting `..` up-front is simpler\n    // and more robust than normalising after the fact.\n    //\n    // Extended guard (Codex P1 #741 round 5): also reject paths containing\n    // backslash separators (`\\`), which are Windows path separators. On Windows\n    // a path like `..\\\\escape.md` or `subdir\\\\..\\\\..\\\\escape.md` would resolve\n    // to a parent traversal but would bypass a purely posix-split check.\n    // Additionally, after posix-normalizing the path we re-check for a leading\n    // `..` or `/` — this catches edge-cases such as `subdir/../..` where the\n    // individual split segments are not `..` but the normalized result is.\n    if (rec.path.includes(\"\\\\\")) {\n      throw new Error(\n        `importCapsule: record path contains backslash separators (Windows-style paths are not allowed): ${rec.path}`,\n      );\n    }\n    const posixNormalized = path.posix.normalize(rec.path);\n    if (\n      rec.path.startsWith(\"/\") ||\n      rec.path.split(\"/\").some((seg) => seg === \"..\") ||\n      posixNormalized.startsWith(\"..\") ||\n      posixNormalized.startsWith(\"/\")\n    ) {\n      throw new Error(\n        `importCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Path-traversal validation (moved here from phase 2 per Cursor feedback:\n    // the traversal check must run before ANY write so a malicious archive\n    // with an escaping path that sorts last cannot land partial writes).\n    //\n    // We build targetAbs relative to the real-resolved root (rootReal) so\n    // that the inside-root check is symlink-aware: if `rootReal !== rootAbs`\n    // (the import root is itself behind a symlink), we still compare against\n    // the canonical path (Codex P1).\n    const targetRel = computeTargetPath(rec.path, mode, capsule.id);\n    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));\n    if (!isPathInsideRoot(rootReal, targetAbs)) {\n      throw new Error(\n        `importCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Symlink-aware containment check (Cursor thread #741 line 247/264).\n    // The lexical check above handles `..`-traversal but cannot detect\n    // symlinked subdirectories that point outside the root. We resolve the\n    // nearest existing ancestor of the target via realpath to catch symlinks\n    // anywhere in the path components. If any resolved prefix escapes rootReal,\n    // the import is rejected before any write. This applies to ALL modes,\n    // including fork mode whose rebase prefix may itself traverse a symlink.\n    await assertRealpathInsideRoot(rootReal, targetAbs, rec.path, \"importCapsule\");\n\n    // Target-file symlink check (Codex P1 #741 round 4, line 260).\n    // `assertRealpathInsideRoot` resolves the nearest existing *ancestor* to\n    // catch symlinked parent directories, but if the TARGET FILE itself already\n    // exists and is a symlink, that check passes (the parent is real) while the\n    // write would silently follow the symlink to a path outside root.  We\n    // therefore lstat the target directly: if it exists and is a symlink we\n    // reject the record up-front.  For new files the parent-canonicalization\n    // performed above is sufficient; no realpath of a non-existent file is\n    // needed.\n    const targetLstat = await lstat(targetAbs).catch(() => null);\n    if (targetLstat !== null && targetLstat.isSymbolicLink()) {\n      throw new Error(\n        `importCapsule: record target is a symlink and cannot be written to safely: ${rec.path}`,\n      );\n    }\n\n    // Duplicate normalized target path detection (Codex P2 #741, line 283).\n    // `path.join` already normalises `.` segments (e.g. `subdir/./file.md` →\n    // `subdir/file.md`).  On case-insensitive filesystems (macOS default,\n    // Windows), two paths that differ only in case would resolve to the same\n    // inode.  We fold the dedup key to lowercase so that `subdir/File.md` and\n    // `subdir/file.md` are detected as duplicates before any write occurs.\n    // This is intentionally unconditional: the cost of an extra `.toLowerCase()`\n    // on case-sensitive filesystems is negligible, and a defensive lowercase\n    // is far simpler than probing filesystem case-sensitivity at runtime.\n    const dedupKey = targetAbs.toLowerCase();\n    const firstSourcePath = seenTargetPaths.get(dedupKey);\n    if (firstSourcePath !== undefined) {\n      throw new Error(\n        `importCapsule: manifest contains two entries that resolve to the same target path: ` +\n          `\"${firstSourcePath}\" and \"${rec.path}\" both map to \"${targetRel}\"`,\n      );\n    }\n    seenTargetPaths.set(dedupKey, rec.path);\n  }\n  // Detect manifest-only entries (missing record). Treat as corruption.\n  for (const f of manifest.files) {\n    if (!recordPaths.has(f.path)) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch (manifest entry without record: ${f.path})`,\n      );\n    }\n  }\n\n  // Phase 2: apply the mode. All records were validated in phase 1; we now\n  // write to disk. Per-record errors propagate; each individual write is\n  // atomic (mkdir + writeFile pair).\n  const imported: ImportCapsuleImportedRecord[] = [];\n  const skipped: ImportCapsuleSkippedRecord[] = [];\n\n  // Sort by source path so the imported/skipped lists are deterministic\n  // regardless of bundle order. (`exportCapsule` already sorts; we re-sort\n  // defensively in case a hand-edited archive ships records in another order.)\n  const sortedRecords = [...bundle.records].sort((a, b) =>\n    a.path.localeCompare(b.path),\n  );\n\n  for (const rec of sortedRecords) {\n    const targetRel = computeTargetPath(rec.path, mode, capsule.id);\n    // Use rootReal (realpath-resolved) to stay consistent with phase 1's\n    // traversal validation and avoid writing through stale symlinks.\n    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));\n\n    const exists = await fileExistsAt(targetAbs);\n\n    // Skip logic applies to both `skip` mode (explicit) and `fork` mode\n    // (Cursor medium: fork mode must also be skip-on-exist for the computed\n    // fork path, because production imports generate non-deterministic IDs —\n    // so re-importing the same capsule should not overwrite user edits in the\n    // fork tree or silently change file identities by generating new IDs).\n    if ((mode === \"skip\" || mode === \"fork\") && exists) {\n      skipped.push({ path: rec.path, reason: \"exists\" });\n      continue;\n    }\n\n    let snapshotted = false;\n    if (mode === \"overwrite\" && exists) {\n      // Gotcha #54: snapshot BEFORE overwriting. If snapshot creation fails\n      // we abort this record's import rather than silently destroying\n      // history. The page-versioning module is responsible for atomic\n      // sidecar writes; we just call it.\n      if (opts.versioning && opts.versioning.enabled) {\n        const prior = await readFile(targetAbs, \"utf-8\").catch(() => \"\");\n        await createVersion(\n          targetAbs,\n          prior,\n          \"manual\",\n          opts.versioning,\n          opts.log,\n          `capsule-import: ${capsule.id}`,\n          rootReal,\n        );\n        snapshotted = true;\n      }\n    }\n\n    let contentToWrite = rec.content;\n    let rewroteId = false;\n    if (mode === \"fork\") {\n      const forked = rewriteFrontmatterIdForFork(rec.content, capsule.id, opts.now);\n      contentToWrite = forked.content;\n      rewroteId = forked.rewrote;\n    }\n\n    await mkdir(path.dirname(targetAbs), { recursive: true });\n    await writeFile(targetAbs, contentToWrite, \"utf-8\");\n    imported.push({\n      sourcePath: rec.path,\n      targetPath: targetRel,\n      snapshotted,\n      rewroteId,\n    });\n  }\n\n  // Sort skipped for stable output (see comment above).\n  skipped.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { imported, skipped, manifest };\n}\n\n// ---------------------------------------------------------------------------\n// Path helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Compute the destination relative path for a record under the chosen\n * mode.\n *\n *  - `skip` / `overwrite` — identity: the record's posix path is used as-is.\n *  - `fork` — rebased under `forks/<capsule-id>/<original-path>` so the\n *    original tree is never modified.\n */\nfunction computeTargetPath(\n  sourcePosix: string,\n  mode: ImportCapsuleMode,\n  capsuleId: string,\n): string {\n  if (mode === \"fork\") return `forks/${capsuleId}/${sourcePosix}`;\n  return sourcePosix;\n}\n\nasync function fileExistsAt(absPath: string): Promise<boolean> {\n  const st = await stat(absPath).catch(() => null);\n  return st !== null && st.isFile();\n}\n\n// ---------------------------------------------------------------------------\n// Fork-mode id rewriting\n// ---------------------------------------------------------------------------\n\n/**\n * Rewrite a YAML-frontmatter `id:` field to a fork-scoped value.\n *\n * Strategy: we deliberately do NOT parse the entire YAML — memory files\n * use a deterministic top-of-file frontmatter delimited by `---` lines,\n * and the orchestrator's `parseFrontmatter` reads `id` as a top-level\n * key with a single-line scalar value. We mirror that contract:\n *\n *   - Detect a leading `---\\n` … `\\n---` block at the top of the file.\n *   - Within that block, locate the first `id:` line that is not nested\n *     under another key (cheap heuristic: line starts at column 0).\n *   - Replace its value with a new fork-id derived from `capsuleId` and\n *     a short random suffix (or {@link opts.now} when provided for tests).\n *\n * Files without a frontmatter block, or without an `id:` key inside one,\n * are returned unchanged with `rewrote: false`. This keeps non-memory\n * artifacts (READMEs, transcripts) byte-identical to the source.\n */\nfunction rewriteFrontmatterIdForFork(\n  content: string,\n  capsuleId: string,\n  now: number | undefined,\n): { content: string; rewrote: boolean } {\n  // Detect the dominant line ending in the file so we can preserve it when\n  // rebuilding the frontmatter delimiters. Splitting/joining on `\\n` silently\n  // drops `\\r` from CRLF files, changing the byte content (Cursor thread #741\n  // line 467). We detect the ending of the very first line (the opening `---`)\n  // and use that as the canonical separator for the reconstructed delimiters.\n  // All three cases are covered: CRLF (\\r\\n), LF (\\n), and bare CR (\\r).\n  const crlfMatch = /^---(\\r\\n|\\r|\\n)/.exec(content);\n  // Fall back to LF if the file starts with `---` but has no newline (EOF).\n  const eol = crlfMatch ? crlfMatch[1] : \"\\n\";\n\n  // Frontmatter block detection: `---` on its own line at the very start,\n  // followed by content, followed by `---` on its own line. The closing\n  // delimiter must be at column 0. We capture the trailing terminator\n  // (`\\r?\\n` or end-of-string) as a separate group so we can re-emit it\n  // verbatim, preserving CRLF/LF/EOF shape from the original file.\n  const fmMatch = /^---\\r?\\n([\\s\\S]*?)\\r?\\n---(\\r?\\n|$)/.exec(content);\n  if (!fmMatch) return { content, rewrote: false };\n  const fmBody = fmMatch[1];\n  const fmTrailer = fmMatch[2];\n  const fmStart = fmMatch.index;\n  const fmEnd = fmStart + fmMatch[0].length;\n\n  // Find a top-level `id:` line. Top-level means the line begins at\n  // column 0 inside the frontmatter body (no leading whitespace) and the\n  // key is exactly `id`. We deliberately accept `id:` and `id : ` shapes\n  // but reject `nested_id:` to avoid touching unrelated keys.\n  const idLineRe = /^id:[ \\t]*([^\\r\\n]*)$/m;\n  const idMatch = idLineRe.exec(fmBody);\n  if (!idMatch) return { content, rewrote: false };\n\n  const newId = mintForkId(capsuleId, idMatch[1]?.trim() ?? \"\", now);\n  const replacedBody = fmBody.replace(idLineRe, `id: ${newId}`);\n  // Reconstruct the file: original prefix (always empty here, fmStart === 0\n  // by the `^` anchor) + frontmatter delimiters around the rewritten body.\n  // Use the detected `eol` for the opening/closing `---` lines so that CRLF\n  // files remain CRLF and LF files remain LF, preserving byte-content fidelity\n  // (Cursor thread #741 line 467).  The captured `fmTrailer` (the newline\n  // immediately after the closing `---`, or end-of-string) is re-emitted\n  // verbatim so the byte immediately after the closing fence is unchanged.\n  const prefix = content.slice(0, fmStart);\n  const tail = content.slice(fmEnd);\n  const rebuilt = `${prefix}---${eol}${replacedBody}${eol}---${fmTrailer}${tail}`;\n  return { content: rebuilt, rewrote: true };\n}\n\n/**\n * Derive a deterministic-when-`now`-is-set fork id from the capsule id and\n * the original record id. Production callers omit `now` and get a UUID\n * suffix; tests pass `now` for byte-stable assertions.\n */\nfunction mintForkId(capsuleId: string, originalId: string, now: number | undefined): string {\n  const base = originalId.length > 0 ? originalId : \"fork\";\n  if (now === undefined) {\n    const suffix = randomUUID().slice(0, 8);\n    return `${base}-fork-${capsuleId}-${suffix}`;\n  }\n  // Deterministic suffix: short hash of (capsuleId, originalId, now). Using\n  // sha256 over a sorted-key serialization (gotcha #38) so the suffix does\n  // not depend on Object.entries order.\n  const payload = JSON.stringify({ c: capsuleId, i: originalId, n: now });\n  const suffix = createHash(\"sha256\").update(payload, \"utf-8\").digest(\"hex\").slice(0, 8);\n  return `${base}-fork-${capsuleId}-${suffix}`;\n}\n\n// Note: `CapsuleBlock` is re-exported here purely so callers that want to\n// inspect the manifest block don't have to deep-import from `./types.js`.\nexport type { CapsuleBlock };\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,OAAO,UAAU,UAAU,MAAM,iBAAiB;AAClE,OAAO,UAAU;AACjB,SAAS,YAAY,kBAAkB;AACvC,SAAS,kBAAkB;AA8I3B,eAAsB,cACpB,MAC8B;AAC9B,QAAM,aAAa,KAAK,QAAQ,KAAK,WAAW;AAChD,QAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;AACtC,QAAM,4BAA4B,SAAS,iBAAiB,MAAM;AAElE,QAAM,OAA0B,KAAK,QAAQ;AAI7C,MAAI,SAAS,UAAU,SAAS,eAAe,SAAS,QAAQ;AAC9D,UAAM,IAAI;AAAA,MACR,+BAA+B,KAAK,UAAU,IAAI,CAAC;AAAA,IACrD;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB,UAAU;AACzD,MAAI;AACJ,MAAI,WAAW;AACb,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,MAAM,2BAA2B,YAAY,KAAK,SAAS;AAAA,EACnE,OAAO;AACL,UAAM,MAAM,SAAS,UAAU;AAAA,EACjC;AACA,QAAM,OAAO,WAAW,GAAG,EAAE,SAAS,OAAO;AAC7C,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,IAAI;AAAA,EAC9B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,0DAA0D,UAAU;AAAA,MACpE,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,OAAO,mBAAmB,GAAG;AAK/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO;AACtB,QAAM,WAAW,OAAO;AACxB,QAAM,UAAU,SAAS;AAKzB,QAAM,gBAAgB,oBAAI,IAA+C;AACzE,aAAW,KAAK,SAAS,OAAO;AAC9B,kBAAc,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7B;AACA,MAAI,cAAc,SAAS,SAAS,MAAM,QAAQ;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,OAAO,OAAO,SAAS;AAChC,QAAI,YAAY,IAAI,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,yDAAyD,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AACA,gBAAY,IAAI,IAAI,IAAI;AAAA,EAC1B;AAYA,QAAM,WAAW,MAAM,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO;AAU5D,QAAM,kBAAkB,oBAAI,IAAoB;AAEhD,aAAW,OAAO,OAAO,SAAS;AAEhC,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,4EAA4E,IAAI,IAAI;AAAA,MACtF;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,aAAa,IAAI,OAAO;AAClD,QAAI,WAAW,MAAM,UAAU,UAAU,MAAM,OAAO;AACpD,YAAM,IAAI;AAAA,QACR,gDAAgD,IAAI,IAAI,qBACnC,MAAM,MAAM,UAAU,MAAM,KAAK,gBACtC,MAAM,UAAU,KAAK;AAAA,MACvC;AAAA,IACF;AAkBA,QAAI,IAAI,KAAK,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,mGAAmG,IAAI,IAAI;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,kBAAkB,KAAK,MAAM,UAAU,IAAI,IAAI;AACrD,QACE,IAAI,KAAK,WAAW,GAAG,KACvB,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,KAC9C,gBAAgB,WAAW,IAAI,KAC/B,gBAAgB,WAAW,GAAG,GAC9B;AACA,YAAM,IAAI;AAAA,QACR,mDAAmD,IAAI,IAAI;AAAA,MAC7D;AAAA,IACF;AAUA,UAAM,YAAY,kBAAkB,IAAI,MAAM,MAAM,QAAQ,EAAE;AAC9D,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,SAAS,CAAC;AACjE,QAAI,CAAC,iBAAiB,UAAU,SAAS,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,mDAAmD,IAAI,IAAI;AAAA,MAC7D;AAAA,IACF;AASA,UAAM,yBAAyB,UAAU,WAAW,IAAI,MAAM,eAAe;AAW7E,UAAM,cAAc,MAAM,MAAM,SAAS,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,gBAAgB,QAAQ,YAAY,eAAe,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,8EAA8E,IAAI,IAAI;AAAA,MACxF;AAAA,IACF;AAWA,UAAM,WAAW,UAAU,YAAY;AACvC,UAAM,kBAAkB,gBAAgB,IAAI,QAAQ;AACpD,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI;AAAA,QACR,uFACM,eAAe,UAAU,IAAI,IAAI,kBAAkB,SAAS;AAAA,MACpE;AAAA,IACF;AACA,oBAAgB,IAAI,UAAU,IAAI,IAAI;AAAA,EACxC;AAEA,aAAW,KAAK,SAAS,OAAO;AAC9B,QAAI,CAAC,YAAY,IAAI,EAAE,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,4EAA4E,EAAE,IAAI;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAA0C,CAAC;AACjD,QAAM,UAAwC,CAAC;AAK/C,QAAM,gBAAgB,CAAC,GAAG,OAAO,OAAO,EAAE;AAAA,IAAK,CAAC,GAAG,MACjD,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EAC7B;AAEA,aAAW,OAAO,eAAe;AAC/B,UAAM,YAAY,kBAAkB,IAAI,MAAM,MAAM,QAAQ,EAAE;AAG9D,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,SAAS,CAAC;AAEjE,UAAM,SAAS,MAAM,aAAa,SAAS;AAO3C,SAAK,SAAS,UAAU,SAAS,WAAW,QAAQ;AAClD,cAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,SAAS,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,cAAc;AAClB,QAAI,SAAS,eAAe,QAAQ;AAKlC,UAAI,KAAK,cAAc,KAAK,WAAW,SAAS;AAC9C,cAAM,QAAQ,MAAM,SAAS,WAAW,OAAO,EAAE,MAAM,MAAM,EAAE;AAC/D,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,KAAK;AAAA,UACL,mBAAmB,QAAQ,EAAE;AAAA,UAC7B;AAAA,QACF;AACA,sBAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,iBAAiB,IAAI;AACzB,QAAI,YAAY;AAChB,QAAI,SAAS,QAAQ;AACnB,YAAM,SAAS,4BAA4B,IAAI,SAAS,QAAQ,IAAI,KAAK,GAAG;AAC5E,uBAAiB,OAAO;AACxB,kBAAY,OAAO;AAAA,IACrB;AAEA,UAAM,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,UAAM,UAAU,WAAW,gBAAgB,OAAO;AAClD,aAAS,KAAK;AAAA,MACZ,YAAY,IAAI;AAAA,MAChB,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAGA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEnD,SAAO,EAAE,UAAU,SAAS,SAAS;AACvC;AAcA,SAAS,kBACP,aACA,MACA,WACQ;AACR,MAAI,SAAS,OAAQ,QAAO,SAAS,SAAS,IAAI,WAAW;AAC7D,SAAO;AACT;AAEA,eAAe,aAAa,SAAmC;AAC7D,QAAM,KAAK,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AAC/C,SAAO,OAAO,QAAQ,GAAG,OAAO;AAClC;AAwBA,SAAS,4BACP,SACA,WACA,KACuC;AAOvC,QAAM,YAAY,mBAAmB,KAAK,OAAO;AAEjD,QAAM,MAAM,YAAY,UAAU,CAAC,IAAI;AAOvC,QAAM,UAAU,uCAAuC,KAAK,OAAO;AACnE,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,MAAM;AAC/C,QAAM,SAAS,QAAQ,CAAC;AACxB,QAAM,YAAY,QAAQ,CAAC;AAC3B,QAAM,UAAU,QAAQ;AACxB,QAAM,QAAQ,UAAU,QAAQ,CAAC,EAAE;AAMnC,QAAM,WAAW;AACjB,QAAM,UAAU,SAAS,KAAK,MAAM;AACpC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,MAAM;AAE/C,QAAM,QAAQ,WAAW,WAAW,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG;AACjE,QAAM,eAAe,OAAO,QAAQ,UAAU,OAAO,KAAK,EAAE;AAQ5D,QAAM,SAAS,QAAQ,MAAM,GAAG,OAAO;AACvC,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,UAAU,GAAG,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,GAAG,MAAM,SAAS,GAAG,IAAI;AAC7E,SAAO,EAAE,SAAS,SAAS,SAAS,KAAK;AAC3C;AAOA,SAAS,WAAW,WAAmB,YAAoB,KAAiC;AAC1F,QAAM,OAAO,WAAW,SAAS,IAAI,aAAa;AAClD,MAAI,QAAQ,QAAW;AACrB,UAAMA,UAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,WAAO,GAAG,IAAI,SAAS,SAAS,IAAIA,OAAM;AAAA,EAC5C;AAIA,QAAM,UAAU,KAAK,UAAU,EAAE,GAAG,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;AACtE,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,SAAS,OAAO,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC;AACrF,SAAO,GAAG,IAAI,SAAS,SAAS,IAAI,MAAM;AAC5C;","names":["suffix"]}