cgraphx 1.1.0

package/scripts/npm-shim.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+'use strict';
+//
+// npm thin-installer launcher for CodeGraph.
+//
+// The heavy artifact (a vendored Node runtime + the app) ships as a per-platform
+// optionalDependency: cgraphx-<platform>-<arch>. npm installs
+// only the one matching the host, via each package's `os`/`cpu` fields (the
+// esbuild pattern). This shim — run by the user's OWN Node — locates that bundle
+// and execs its launcher, so the real work always runs on the bundled Node 24
+// (with node:sqlite), regardless of the user's Node version. The user's Node is
+// only ever a launcher; even an ancient version can run this file.
+//
+// Self-heal (issue #303): some registries — notably the npmmirror/cnpm mirrors,
+// and some corporate proxies — don't reliably mirror the per-platform
+// optionalDependencies. npm treats an unfetchable optional dep as success and
+// silently skips it, so the bundle goes missing and every command fails. When
+// the installed bundle can't be resolved, this shim falls back to downloading
+// the matching bundle straight from GitHub Releases — the very archive
+// install.sh uses — into a cache dir, then runs that. Knobs:
+//   CGRAPHX_NO_DOWNLOAD=1     disable the network fallback (print guidance)
+//   CGRAPHX_INSTALL_DIR=DIR   cache location (default: ~/.cgraphx)
+//   CGRAPHX_DOWNLOAD_BASE=URL release-download base (for mirrors/air-gapped)
+//
+// Wired up at release time as the main package's `bin`:
+//   "bin": { "cgraphx": "npm-shim.js" }
+// with the platform packages listed in `optionalDependencies`.
+
+var childProcess = require('child_process');
+var fs = require('fs');
+var os = require('os');
+var path = require('path');
+
+var target = process.platform + '-' + process.arch; // e.g. darwin-arm64, linux-x64
+var pkg = 'cgraphx-' + target;
+var isWindows = process.platform === 'win32';
+var REPO = 'smdnkB/cgraphx';
+
+main().catch(function (e) {
+  process.stderr.write('cgraphx: ' + (e && e.message ? e.message : String(e)) + '\n');
+  process.exit(1);
+});
+
+async function main() {
+  // Happy path: the npm-installed optional dependency. Fall back to a download
+  // when the registry didn't deliver it.
+  var resolved = resolveInstalledBundle() || (await selfHealBundle());
+  var res = childProcess.spawnSync(resolved.command, resolved.args, { stdio: 'inherit' });
+  if (res.error) {
+    process.stderr.write('cgraphx: ' + res.error.message + '\n');
+    process.exit(1);
+  }
+  process.exit(res.status === null ? 1 : res.status);
+}
+
+// Resolve the launcher from the installed per-platform optionalDependency.
+// Returns {command, args} or null if the package isn't installed.
+function resolveInstalledBundle() {
+  try {
+    if (isWindows) {
+      // Modern Node refuses to spawn the bundle's .cmd directly (EINVAL, the
+      // CVE-2024-27980 hardening on Node 24), so invoke the bundled node.exe
+      // against the app entry point and pass --liftoff-only here.
+      var nodeExe = require.resolve(pkg + '/node.exe');
+      var entry = require.resolve(pkg + '/lib/dist/bin/codegraph.js');
+      return { command: nodeExe, args: liftoff(entry) };
+    }
+    return { command: require.resolve(pkg + '/bin/cgraphx'), args: process.argv.slice(2) };
+  } catch (e) {
+    return null;
+  }
+}
+
+// Locate the launcher inside an extracted GitHub bundle directory (same
+// node/lib/bin layout as the npm platform package). Returns {command, args} or
+// null when the directory doesn't hold a usable bundle yet.
+function launcherIn(dir) {
+  if (isWindows) {
+    var nodeExe = path.join(dir, 'node.exe');
+    var entry = path.join(dir, 'lib', 'dist', 'bin', 'codegraph.js');
+    if (fs.existsSync(nodeExe) && fs.existsSync(entry)) {
+      return { command: nodeExe, args: liftoff(entry) };
+    }
+  } else {
+    var launcher = path.join(dir, 'bin', 'cgraphx');
+    if (fs.existsSync(launcher)) return { command: launcher, args: process.argv.slice(2) };
+  }
+  return null;
+}
+
+// --liftoff-only keeps tree-sitter's WASM grammars off V8's turboshaft tier to
+// avoid the Zone OOM on Node >= 22 (issues #293/#298). The unix bin/cgraphx
+// launcher already passes it; on Windows we invoke node.exe directly so add it.
+function liftoff(entry) {
+  return ['--liftoff-only', entry].concat(process.argv.slice(2));
+}
+
+// Download + cache the platform bundle from GitHub Releases. Returns
+// {command, args}; exits the process with guidance if it can't.
+async function selfHealBundle() {
+  var version = readVersion();
+  var bundlesDir = path.join(process.env.CGRAPHX_INSTALL_DIR || path.join(os.homedir(), '.cgraphx'), 'bundles');
+  var dest = path.join(bundlesDir, target + '-' + version);
+
+  // Already downloaded by a previous run? Use it even when downloads are
+  // disabled — CGRAPHX_NO_DOWNLOAD blocks fetching, not a cached bundle.
+  var cached = launcherIn(dest);
+  if (cached) return cached;
+
+  if (process.env.CGRAPHX_NO_DOWNLOAD) {
+    fail('the network fallback is disabled (CGRAPHX_NO_DOWNLOAD is set).');
+  }
+
+  var asset = 'cgraphx-' + target + (isWindows ? '.zip' : '.tar.gz');
+  var base = process.env.CGRAPHX_DOWNLOAD_BASE || ('https://github.com/' + REPO + '/releases/download');
+  var url = base + '/v' + version + '/' + asset;
+
+  process.stderr.write(
+    'cgraphx: platform bundle missing (registry did not provide ' + pkg + ').\n' +
+    'cgraphx: downloading ' + asset + ' from GitHub Releases (' + version + ')...\n'
+  );
+
+  // Stage inside bundlesDir so the final rename is on the same filesystem (atomic,
+  // no EXDEV across tmpfs). Strip the archive's top-level cgraphx-<target>/ dir.
+  fs.mkdirSync(bundlesDir, { recursive: true });
+  var stage = fs.mkdtempSync(path.join(bundlesDir, '.dl-'));
+  try {
+    var archivePath = path.join(stage, asset);
+    await download(url, archivePath, 6);
+    await verifyChecksum(archivePath, asset, base, version);
+    var extracted = path.join(stage, 'bundle');
+    fs.mkdirSync(extracted);
+    extract(archivePath, extracted);
+
+    var raced = launcherIn(dest); // another process may have finished meanwhile
+    if (raced) { rmrf(stage); return raced; }
+    try {
+      fs.renameSync(extracted, dest);
+    } catch (e) {
+      var other = launcherIn(dest); // lost the race but theirs is valid
+      if (other) { rmrf(stage); return other; }
+      throw e;
+    }
+  } catch (e) {
+    rmrf(stage);
+    fail('download failed (' + e.message + ').\n  URL: ' + url);
+  }
+  rmrf(stage);
+
+  var ready = launcherIn(dest);
+  if (!ready) fail('downloaded bundle is missing its launcher under ' + dest + '.');
+  process.stderr.write('cgraphx: bundle ready.\n');
+  return ready;
+}
+
+function readVersion() {
+  try {
+    return require(path.join(__dirname, 'package.json')).version;
+  } catch (e) {
+    fail('could not read this package\'s version to locate a matching release.');
+  }
+}
+
+// GET with manual redirect following (GitHub release URLs redirect to a CDN).
+function download(url, dest, redirectsLeft) {
+  return new Promise(function (resolve, reject) {
+    var https = require('https');
+    // timeout is an idle/inactivity timeout — it won't kill a slow-but-progressing
+    // download, only a stalled connection (so a blocked mirror fails fast with
+    // guidance instead of hanging the user's command forever).
+    var req = https.get(url, { headers: { 'User-Agent': 'codegraph-npm-shim' }, timeout: 30000 }, function (res) {
+      var status = res.statusCode;
+      if (status >= 300 && status < 400 && res.headers.location) {
+        res.resume();
+        if (redirectsLeft <= 0) { reject(new Error('too many redirects')); return; }
+        download(new URL(res.headers.location, url).toString(), dest, redirectsLeft - 1).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) { res.resume(); reject(new Error('HTTP ' + status)); return; }
+      var file = fs.createWriteStream(dest);
+      res.on('error', reject);
+      res.pipe(file);
+      file.on('error', reject);
+      file.on('finish', function () { file.close(function () { resolve(); }); });
+    });
+    req.on('timeout', function () { req.destroy(new Error('connection timed out')); });
+    req.on('error', reject);
+  });
+}
+
+// Best-effort integrity check. When the release publishes a SHA256SUMS file, the
+// downloaded archive MUST match its listed hash or we abort. When that file is
+// absent (older releases) or simply unreachable, we proceed — the archive still
+// arrived from GitHub over TLS. So tampering/corruption is caught, while a
+// missing checksum never breaks an install.
+async function verifyChecksum(archivePath, asset, base, version) {
+  var sumsPath = archivePath + '.SHA256SUMS';
+  try {
+    await download(base + '/v' + version + '/SHA256SUMS', sumsPath, 6);
+  } catch (e) {
+    return; // not published / unreachable → skip
+  }
+  var expected = null;
+  var lines = fs.readFileSync(sumsPath, 'utf8').split('\n');
+  for (var i = 0; i < lines.length; i++) {
+    var m = lines[i].trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
+    if (m && path.basename(m[2].trim()) === asset) { expected = m[1].toLowerCase(); break; }
+  }
+  if (!expected) return; // asset not listed → nothing to check
+  var actual = require('crypto').createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
+  if (actual !== expected) {
+    throw new Error('checksum mismatch for ' + asset +
+      ' (expected ' + expected.slice(0, 12) + '…, got ' + actual.slice(0, 12) + '…)');
+  }
+  process.stderr.write('cgraphx: checksum verified.\n');
+}
+
+// Extract via the system tar — present on macOS, Linux, and Windows 10+
+// (bsdtar reads .zip too). No third-party dependency in the shim.
+function extract(archive, destDir) {
+  var args = isWindows
+    ? ['-xf', archive, '-C', destDir, '--strip-components=1']
+    : ['-xzf', archive, '-C', destDir, '--strip-components=1'];
+  var res = childProcess.spawnSync('tar', args, { stdio: 'ignore' });
+  if (res.error) throw new Error('tar unavailable: ' + res.error.message);
+  if (res.status !== 0) throw new Error('tar exited ' + res.status);
+}
+
+function rmrf(p) {
+  try { fs.rmSync(p, { recursive: true, force: true }); } catch (e) { /* best effort */ }
+}
+
+function fail(reason) {
+  process.stderr.write(
+    'cgraphx: no prebuilt bundle for ' + target + '.\n' +
+    (reason ? 'cgraphx: ' + reason + '\n' : '') +
+    'Expected the optional package ' + pkg + ' to be installed.\n' +
+    'A registry mirror (e.g. npmmirror/cnpm) that did not mirror the per-platform\n' +
+    'package is the usual cause. Fixes:\n' +
+    '  - install from the official registry:\n' +
+    '      npm i -g cgraphx --registry=https://registry.npmjs.org\n' +
+    '  - or use the standalone installer (no Node required):\n' +
+    '      curl -fsSL https://raw.githubusercontent.com/' + REPO + '/main/install.sh | sh\n'
+  );
+  process.exit(1);
+}

package/scripts/pack-npm.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#
+# Assemble the npm thin-installer packages from built bundles (esbuild pattern).
+#
+# Produces, under release/npm/:
+#   cgraphx-<target>/   one per built bundle — the vendored Node + app, tagged
+#                       with os/cpu so npm installs only the matching one.
+#   main/               the cgraphx shim package: a tiny bin
+#                       that execs the matching platform bundle, with every
+#                       platform package in optionalDependencies.
+#
+# The release pipeline then `npm publish`es each dir. This does NOT touch the
+# repo's package.json — the dev/from-source path keeps working; the *published*
+# main package's shape is generated here.
+#
+# Prereq: run build-bundle.sh for each target first (release/cgraphx-*.tar.gz).
+# Usage:  scripts/pack-npm.sh [version]    (default: version from package.json)
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+VERSION="${1:-$(node -p "require('$ROOT/package.json').version")}"
+REL="$ROOT/release"
+NPM="$REL/npm"
+
+rm -rf "$NPM"
+mkdir -p "$NPM/main"
+
+shopt -s nullglob
+archives=("$REL"/cgraphx-*.tar.gz "$REL"/cgraphx-*.zip)
+[ ${#archives[@]} -gt 0 ] || { echo "[pack-npm] no bundles in $REL — run build-bundle.sh first" >&2; exit 1; }
+
+targets=()
+for archive in "${archives[@]}"; do
+  fname="$(basename "$archive")"
+  case "$fname" in
+    *.tar.gz) base="${fname%.tar.gz}" ;;   # cgraphx-<target>
+    *.zip)    base="${fname%.zip}" ;;
+  esac
+  target="${base#cgraphx-}"              # <target>, e.g. darwin-arm64 / win32-x64
+  os="${target%-*}"                       # darwin | linux | win32
+  arch="${target##*-}"                    # arm64 | x64
+  pkgdir="$NPM/$base"
+  mkdir -p "$pkgdir"
+  case "$fname" in
+    *.zip)
+      tmpx="$(mktemp -d)"
+      unzip -q "$archive" -d "$tmpx"
+      mv "$tmpx/cgraphx-${target}"/* "$pkgdir"/
+      rm -rf "$tmpx"
+      nodefile="node.exe"
+      ;;
+    *)
+      tar -xzf "$archive" -C "$pkgdir" --strip-components=1
+      nodefile="node"
+      ;;
+  esac
+  VERSION="$VERSION" TARGET="$target" OSV="$os" ARCHV="$arch" NODEFILE="$nodefile" \
+    node -e '
+      const fs=require("fs");
+      fs.writeFileSync(process.argv[1], JSON.stringify({
+        name: `cgraphx-${process.env.TARGET}`,
+        version: process.env.VERSION,
+        description: `CodeGraph self-contained bundle for ${process.env.TARGET}`,
+        os: [process.env.OSV], cpu: [process.env.ARCHV],
+        files: [process.env.NODEFILE, "lib", "bin"],
+        license: "MIT"
+      }, null, 2) + "\n");
+    ' "$pkgdir/package.json"
+  targets+=("$target")
+  echo "[pack-npm] cgraphx-${target}@${VERSION}"
+done
+
+# Main shim package.
+#   npm-shim.js  CLI/MCP launcher (execs the bundled Node) — the `bin`.
+#   npm-sdk.js   programmatic/embedded entry (#354): re-exports the installed
+#                platform bundle's compiled library — the `main`.
+#   dist/        the .d.ts tree only (types). The runtime .js stays in the
+#                per-platform bundle so its deps aren't duplicated here.
+cp "$ROOT/scripts/npm-shim.js" "$NPM/main/npm-shim.js"
+cp "$ROOT/scripts/npm-sdk.js" "$NPM/main/npm-sdk.js"
+[ -f "$ROOT/README.md" ] && cp "$ROOT/README.md" "$NPM/main/README.md"
+
+# Ship the type declarations so `types`/`exports.types` resolve. Built from this
+# same release, so they can't skew from the runtime npm-sdk.js re-exports.
+[ -f "$ROOT/dist/index.d.ts" ] || ( echo "[pack-npm] building dist for .d.ts" >&2 && cd "$ROOT" && npm run build >/dev/null )
+ROOT="$ROOT" DEST="$NPM/main" node -e '
+  const fs=require("fs"), path=require("path");
+  const src=path.join(process.env.ROOT,"dist"), dest=path.join(process.env.DEST,"dist");
+  fs.cpSync(src, dest, { recursive:true, filter(s){
+    try { return fs.statSync(s).isDirectory() || s.endsWith(".d.ts"); } catch (e) { return false; }
+  }});
+'
+
+VERSION="$VERSION" TARGETS="${targets[*]}" \
+  node -e '
+    const fs=require("fs");
+    const opt={};
+    for (const t of process.env.TARGETS.split(/\s+/).filter(Boolean))
+      opt[`cgraphx-${t}`]=process.env.VERSION;
+    fs.writeFileSync(process.argv[1], JSON.stringify({
+      name: `cgraphx`,
+      version: process.env.VERSION,
+      description: "Local-first code intelligence for AI agents (MCP). Self-contained — bundles its own runtime.",
+      bin: { cgraphx: "npm-shim.js" },
+      main: "npm-sdk.js",
+      types: "dist/index.d.ts",
+      exports: {
+        ".": { types: "./dist/index.d.ts", default: "./npm-sdk.js" },
+        "./package.json": "./package.json"
+      },
+      optionalDependencies: opt,
+      files: ["npm-shim.js","npm-sdk.js","dist","README.md"],
+      license: "MIT"
+    }, null, 2) + "\n");
+  ' "$NPM/main/package.json"
+
+echo "[pack-npm] cgraphx@${VERSION} (${#targets[@]} platform packages in optionalDependencies)"
+echo "[pack-npm] output: $NPM"

package/scripts/prepare-release.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+/**
+ * Promote `## [Unreleased]` content into `## [<version>]` in CHANGELOG.md
+ * so the release.yml workflow's `extract-release-notes.mjs <version>` call
+ * picks up everything that landed since the last release.
+ *
+ * **Why this exists:** the release workflow used to do a literal
+ * `extract-release-notes.mjs <version>` lookup with an `[Unreleased]`
+ * fallback. The fallback only triggers if the `[<version>]` block
+ * doesn't exist at all — and in practice maintainers sometimes had a
+ * sparse `[<version>]` block pre-populated (e.g. one early fix
+ * documented before the rest of the work landed). The workflow then
+ * extracted that sparse block, ignoring the much larger `[Unreleased]`
+ * section above it — so the published release notes were missing most
+ * of what shipped. See v0.9.5 for the canonical post-mortem.
+ *
+ * **What it does**, idempotently:
+ *
+ *   Case A — `[<version>]` does not exist yet:
+ *     Rename the `[Unreleased]` header to `[<version>] - <YYYY-MM-DD>`
+ *     and add a fresh empty `## [Unreleased]` block above it. This is
+ *     the common case.
+ *
+ *   Case B — `[<version>]` exists AND `[Unreleased]` has content:
+ *     Merge `[Unreleased]`'s sub-sections (### Added / ### Fixed /
+ *     ### Changed / ### Removed / ### Deprecated / ### Security) into
+ *     the corresponding sub-sections of `[<version>]`. Unmatched
+ *     sub-sections are appended to `[<version>]`. The `[Unreleased]`
+ *     block is then emptied.
+ *
+ *   Case C — `[Unreleased]` has no content:
+ *     No-op. Exit 0. Re-runs of the workflow are safe.
+ *
+ * **Where the date comes from:** for Case A, `<YYYY-MM-DD>` is the
+ * UTC date at run time. Matches the existing CHANGELOG convention.
+ *
+ * **Usage:**
+ *
+ *   node scripts/prepare-release.mjs                # reads version from package.json
+ *   node scripts/prepare-release.mjs 1.2.3          # explicit version
+ *
+ * **Output:**
+ *
+ *   Writes CHANGELOG.md in place. Prints a summary line to stdout
+ *   like `prepare-release: 0.9.5 — promoted 6 Unreleased entries`.
+ *   Exits non-zero on parse failures.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const CHANGELOG_PATH = resolve(process.cwd(), 'CHANGELOG.md');
+
+function readPackageVersion() {
+  const pkg = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf8'));
+  if (!pkg.version) throw new Error('package.json has no "version" field');
+  return pkg.version;
+}
+
+function todayUtcIsoDate() {
+  // YYYY-MM-DD in UTC. Matches the CHANGELOG's existing convention
+  // (the existing dated entries don't disclose a timezone, but UTC is
+  // stable across runners and is what the workflow's runner produces
+  // by default anyway).
+  return new Date().toISOString().slice(0, 10);
+}
+
+/**
+ * Split the CHANGELOG into a header preface + an ordered list of
+ * version blocks `{ header, body[] }`, preserving line content
+ * verbatim so we can re-join without surprises.
+ */
+function parseChangelog(text) {
+  const lines = text.split('\n');
+  const versionHeaderRe = /^## \[([^\]]+)\](?:\s+-\s+(.+))?\s*$/;
+  const preface = [];
+  const blocks = []; // { header: string, name: string, body: string[] }
+  let cur = null;
+  for (const line of lines) {
+    const m = line.match(versionHeaderRe);
+    if (m) {
+      if (cur) blocks.push(cur);
+      cur = { header: line, name: m[1], date: m[2] ?? null, body: [] };
+    } else if (cur) {
+      cur.body.push(line);
+    } else {
+      preface.push(line);
+    }
+  }
+  if (cur) blocks.push(cur);
+  return { preface, blocks };
+}
+
+function joinChangelog({ preface, blocks }) {
+  const parts = [preface.join('\n')];
+  for (const b of blocks) {
+    // Reconstruct: header + body. The block body INCLUDES the blank
+    // line after the header (it was captured verbatim).
+    parts.push([b.header, ...b.body].join('\n'));
+  }
+  return parts.join('\n');
+}
+
+/**
+ * Split a block body into ordered sub-sections keyed by their
+ * `### Heading`. Lines before the first `### Heading` go in
+ * `leading`. Preserves the original (line-array) body inside each
+ * sub-section so we can splice cleanly when merging.
+ */
+function splitSubsections(body) {
+  const subsectionRe = /^### (\w+)\s*$/;
+  const leading = [];
+  const subs = []; // { heading: 'Added' | 'Fixed' | …, headerLine: string, body: string[] }
+  let cur = null;
+  for (const line of body) {
+    const m = line.match(subsectionRe);
+    if (m) {
+      if (cur) subs.push(cur);
+      cur = { heading: m[1], headerLine: line, body: [] };
+    } else if (cur) {
+      cur.body.push(line);
+    } else {
+      leading.push(line);
+    }
+  }
+  if (cur) subs.push(cur);
+  return { leading, subs };
+}
+
+function rebuildBody({ leading, subs }) {
+  const parts = [];
+  if (leading.length) parts.push(leading.join('\n'));
+  for (const s of subs) {
+    parts.push([s.headerLine, ...s.body].join('\n'));
+  }
+  return parts.join('\n').split('\n');
+}
+
+/**
+ * Return true when the block has any meaningful entries (a bullet line
+ * starting with `-`, `*`, or a digit) — vs. being empty / just
+ * whitespace / just sub-section headers with nothing under them.
+ */
+function blockHasContent(body) {
+  for (const line of body) {
+    if (/^\s*([-*]|\d+\.)\s+/.test(line)) return true;
+  }
+  return false;
+}
+
+/**
+ * Trim trailing blank lines from an array of lines, then return.
+ * Keeps the output tidy when merging.
+ */
+function trimTrailingBlank(arr) {
+  let i = arr.length;
+  while (i > 0 && /^\s*$/.test(arr[i - 1])) i--;
+  return arr.slice(0, i);
+}
+
+function main() {
+  const versionArg = process.argv[2];
+  const version = versionArg || readPackageVersion();
+
+  const text = readFileSync(CHANGELOG_PATH, 'utf8');
+  const parsed = parseChangelog(text);
+
+  const unrelIdx = parsed.blocks.findIndex((b) => b.name === 'Unreleased');
+  const verIdx = parsed.blocks.findIndex((b) => b.name === version);
+
+  if (unrelIdx === -1) {
+    console.log(`prepare-release: no [Unreleased] block — nothing to do`);
+    return;
+  }
+
+  const unrel = parsed.blocks[unrelIdx];
+  if (!blockHasContent(unrel.body)) {
+    console.log(`prepare-release: [Unreleased] is empty — nothing to do`);
+    return;
+  }
+
+  if (verIdx === -1) {
+    // Case A — promote Unreleased → [version].
+    const today = todayUtcIsoDate();
+    const promoted = {
+      header: `## [${version}] - ${today}`,
+      name: version,
+      date: today,
+      body: trimTrailingBlank(unrel.body).concat(['']), // single trailing blank
+    };
+    const emptied = {
+      header: `## [Unreleased]`,
+      name: 'Unreleased',
+      date: null,
+      body: ['', ''], // two blank lines for the next round of entries
+    };
+    parsed.blocks.splice(unrelIdx, 1, emptied, promoted);
+    const next = joinChangelog(parsed);
+    writeFileSync(CHANGELOG_PATH, appendLinkRef(next, version));
+    console.log(`prepare-release: ${version} — renamed [Unreleased] to [${version}] - ${today}`);
+    return;
+  }
+
+  // Case B — merge Unreleased sub-sections into the existing
+  // [version] sub-sections. New sub-section headings encountered in
+  // Unreleased that don't exist in [version] get appended.
+  const ver = parsed.blocks[verIdx];
+  const unrelSubs = splitSubsections(unrel.body);
+  const verSubs = splitSubsections(ver.body);
+
+  let merged = 0;
+  for (const us of unrelSubs.subs) {
+    const target = verSubs.subs.find((s) => s.heading === us.heading);
+    const usBody = trimTrailingBlank(us.body);
+    if (usBody.length === 0) continue;
+    if (target) {
+      // Append Unreleased's entries to the end of the version's matching
+      // sub-section, keeping their original ordering. Insert a separating
+      // blank line if the existing sub-section doesn't already end in one.
+      const existing = trimTrailingBlank(target.body);
+      const sep = existing.length && !/^\s*$/.test(existing[existing.length - 1]) ? [''] : [];
+      target.body = existing.concat(sep, usBody, ['']);
+    } else {
+      // Append the whole sub-section to the end.
+      verSubs.subs.push({
+        heading: us.heading,
+        headerLine: us.headerLine,
+        body: usBody.concat(['']),
+      });
+    }
+    merged += usBody.filter((l) => /^\s*([-*]|\d+\.)\s+/.test(l)).length;
+  }
+
+  ver.body = rebuildBody(verSubs);
+  // Empty out Unreleased.
+  unrel.body = ['', ''];
+
+  const merged_text = joinChangelog(parsed);
+  writeFileSync(CHANGELOG_PATH, appendLinkRef(merged_text, version));
+  console.log(`prepare-release: ${version} — merged ${merged} Unreleased entries into existing [${version}] block`);
+}
+
+/**
+ * Append a `[X.Y.Z]: https://github.com/smdnkB/cgraphx/releases/tag/vX.Y.Z`
+ * link reference at the end of the file IF one doesn't already exist. The
+ * link ref is what makes `## [X.Y.Z]` heading text auto-link to its tag in
+ * GitHub's renderer; without it the heading still renders, just unlinked.
+ *
+ * Idempotent. The existing CHANGELOG mixes link refs scattered through the
+ * file and a sorted block at the bottom — we just append at the very end,
+ * which CommonMark accepts regardless.
+ */
+function appendLinkRef(text, version) {
+  const refLine = `[${version}]: https://github.com/smdnkB/cgraphx/releases/tag/v${version}`;
+  // Already there? Look for a line that EQUALS this (anywhere in the file)
+  // to keep idempotency robust against the scattered-vs-block layout.
+  const lines = text.split('\n');
+  if (lines.some((l) => l.trim() === refLine)) return text;
+  // Append, separated by a blank line from the prior content. Preserve a
+  // single trailing newline at EOF.
+  const trailingNewline = text.endsWith('\n') ? '' : '\n';
+  return text + trailingNewline + refLine + '\n';
+}
+
+try {
+  main();
+} catch (err) {
+  console.error(`prepare-release: ${err?.message ?? err}`);
+  process.exit(1);
+}