emdash 0.39.0 → 0.40.0

package/dist/cli/index.mjs

@@ -1,62 +1,76 @@
 #!/usr/bin/env node
-import { a as getMigrationStatus, c as formatDatetimeStorageReport, i as getExactMigrationStatus, l as scanDatetimeStorage, s as runMigrations, u as __exportAll } from "../runner-ClrleR8A.mjs";
+import { a as getMigrationStatus, c as formatDatetimeStorageReport, i as getExactMigrationStatus, l as scanDatetimeStorage, s as runMigrations, u as __exportAll } from "../runner-1y4J9fJB.mjs";
 import { t as EmDashDatabaseError } from "../errors-9P_FDrJ_.mjs";
 import { n as isMissingTableError } from "../db-errors-CBD5yMro.mjs";
 import { busyLockHeldSince, migrationLockHeldMessage } from "../database/migration-lock.mjs";
 import { t as validateIdentifier } from "../validate-DANX1-Qi.mjs";
-import { p as listTablesLike } from "../dialect-helpers-CtYdsX4W.mjs";
-import { i as isI18nEnabled, r as getI18nConfig } from "../config-CGVeT8Hc.mjs";
+import { m as listTablesLike } from "../dialect-helpers-7_IqPdh9.mjs";
+import { i as isI18nEnabled, r as getI18nConfig } from "../config-CvmjJcVw.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
 import "../after-PcEvMY_6.mjs";
-import { t as OptionsRepository } from "../options-D5WcorD5.mjs";
+import { t as OptionsRepository } from "../options-DhrI7eMv.mjs";
 import { a as encodeBase64url } from "../base64-DvnNgP7e.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-DNgVgz_e.mjs";
-import { t as ContentRepository } from "../content-DZ3B5qtA.mjs";
-import "../object-cache-DlSVbn5Y.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-CIi0nFiR.mjs";
+import { t as ContentRepository } from "../content-DFaIEDj9.mjs";
+import "../object-cache-CqWNY5uP.mjs";
 import { n as slugify } from "../slugify-T5GHH42D.mjs";
 import "../types-BkUg2yHx.mjs";
-import { t as MediaRepository } from "../media-TBlKCwo7.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-Dj1vpw5E.mjs";
-import "../resolve-BJIS8wKr.mjs";
-import "../redirect-D2Yo-b6S.mjs";
-import "../request-cache-DaMhSQdx.mjs";
-import "../byline-registry-D6lWzXk6.mjs";
-import "../field-defs-cache-B337z8UJ.mjs";
-import { t as BylineRepository } from "../byline-Doh-wt99.mjs";
-import { t as imageSize } from "../dist-2hDLsLeq.mjs";
-import "../fts-manager-DMb0sbIQ.mjs";
+import { t as MediaRepository } from "../media-Qp5S3eH3.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-C3Fu1YeH.mjs";
+import "../resolve-2WbQsCvT.mjs";
+import "../redirect-iJf5fltD.mjs";
+import "../request-cache-DzLYKm_x.mjs";
+import "../byline-registry-gnKscbQX.mjs";
+import "../field-defs-cache-HIgBbqZZ.mjs";
+import { t as BylineRepository } from "../byline-DYmkXqvo.mjs";
+import { t as imageSize } from "../dist-BNwANFJR.mjs";
+import "../fts-manager-S-K0laoS.mjs";
+import { f as parseTaxonomyCollections, m as selectTaxonomyDefs } from "../loader-BzqeR1ZN.mjs";
 import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../loader-t4TxaFiQ.mjs";
-import "../collection-slugs-cache-D9auiKmI.mjs";
-import "../capture-triggers-gxQxnxrJ.mjs";
-import "../activation-CaMfdBt1.mjs";
-import "../collection-deletion-C3Xixmkx.mjs";
-import "../content-refresh-BHLHJgyt.mjs";
-import { n as SchemaRegistry } from "../registry-CkuPoZs7.mjs";
-import "../settings-DmroR53o.mjs";
-import { a as pluginManifestBaseSchema } from "../manifest-schema-Bkh8SeHd.mjs";
-import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess$1, r as declaredAccessToCapabilities$1, t as CAPABILITY_RENAMES } from "../types-k--LneIF.mjs";
-import "../ssrf-Co1GGFZz.mjs";
-import "../ssrf-BRpTDMV6.mjs";
-import { t as validateSeed } from "../validate-BCP9HNDn.mjs";
-import { t as applySeed } from "../apply-drpfmqrR.mjs";
-import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-D31UoJCu.mjs";
-import "../identity-DRGSHEEr.mjs";
-import { t as openNodeSqliteDatabase } from "../node-sqlite-compat-vpVaILnb.mjs";
+import "../collection-slugs-cache-CjGk__zp.mjs";
+import "../capture-triggers-kJyl_yyM.mjs";
+import "../activation-LOkDM5WT.mjs";
+import { a as SchemaRegistry, t as BlockTypeRegistry } from "../block-type-registry-DUI_3KxT.mjs";
+import "../collection-deletion-BIm28mo3.mjs";
+import { r as isTransferError, t as TransferError } from "../errors-DgE1zJGG.mjs";
+import "../canonical-YhEQezjg.mjs";
+import { d as sha256Hex, i as createSha256, s as packageDigest } from "../digest-BarSh-pN.mjs";
+import "../hash-SDAW6zC-.mjs";
+import "../zod-generator-D6uE4WiS.mjs";
+import "../block-values-C_VIPr5t.mjs";
+import "../settings-DYidIB26.mjs";
+import "../settings-CgjRWGW9.mjs";
+import { a as pluginManifestBaseSchema } from "../manifest-schema-CY3zng_M.mjs";
+import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess$1, r as declaredAccessToCapabilities$1, t as CAPABILITY_RENAMES } from "../types-BZakh7Ym.mjs";
+import "../ssrf-CJUnJymJ.mjs";
+import { t as applySeed } from "../apply-CoT603H3.mjs";
+import "../ssrf-DpBH7aOt.mjs";
+import { n as validateSeed } from "../validate-CHosPEhs.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-B8zR-73J.mjs";
+import "../identity-IyNWwXr6.mjs";
+import { t as openNodeSqliteDatabase } from "../node-sqlite-compat-CONMsl-x.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as convertDataForRead } from "../portable-text-oAwodbPS.mjs";
+import { t as convertDataForRead } from "../portable-text-5O_ZGUjB.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
-import { EmDashClient } from "../client/index.mjs";
+import { EmDashApiError, EmDashClient } from "../client/index.mjs";
+import { a as parseIndexLine, n as unpackSitePackage, o as parseManifest, r as decodeUtf8, t as packSitePackage } from "../tar-_1AgTYFu.mjs";
+import "../kinds-CRu_T5T5.mjs";
+import { t as MANIFEST_PATH } from "../paths-JxokKIbr.mjs";
+import "../transformations-9gfpwY65.mjs";
+import "../version-BRZXVifl.mjs";
+import { r as verifyReceiptDigest } from "../receipt-B4wJj5Jq.mjs";
 import { createRequire } from "node:module";
 import { Kysely, SqliteDialect, sql } from "kysely";
 import { z } from "zod";
+import { ulid } from "ulidx";
 import { extractManifestRoute, extractRouteOptions, isJsonPostRouteContract } from "@emdash-cms/plugin-types";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { pathToFileURL } from "node:url";
 import { createHash } from "node:crypto";
-import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { access, copyFile, mkdir, readFile, readdir, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, parse, resolve } from "node:path";
-import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { Readable, Writable } from "node:stream";
 import { defineCommand, runCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
@@ -268,7 +282,8 @@ function removeMarketplaceCredential(registryUrl) {
 //#region src/cli/client-factory.ts
 var client_factory_exports = /* @__PURE__ */ __exportAll({
 	connectionArgs: () => connectionArgs,
-	createClientFromArgs: () => createClientFromArgs
+	createClientFromArgs: () => createClientFromArgs,
+	resolveBaseUrl: () => resolveBaseUrl
 });
 /**
 * Shared connection args for all CLI commands that talk to an EmDash instance.
@@ -295,6 +310,10 @@ const connectionArgs = {
 		description: "Output as JSON"
 	}
 };
+/** The instance URL from `--url`, `EMDASH_URL`, or the local dev default. */
+function resolveBaseUrl(args) {
+	return args.url || process.env["EMDASH_URL"] || "http://localhost:4321";
+}
 /**
 * Create an EmDashClient from CLI args, env vars, and stored credentials.
 *
@@ -310,7 +329,7 @@ const connectionArgs = {
 * 3. --header CLI flags
 */
 function createClientFromArgs(args) {
-	const baseUrl = args.url || process.env["EMDASH_URL"] || "http://localhost:4321";
+	const baseUrl = resolveBaseUrl(args);
 	let token = args.token || process.env["EMDASH_TOKEN"];
 	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
 	const cred = !token ? getCredentials(baseUrl) : null;
@@ -1427,6 +1446,7 @@ async function exportSeed(db, withContent) {
 		}
 	};
 	seed.settings = await exportSettings(db);
+	seed.blockTypes = await exportBlockTypes(db);
 	seed.collections = await exportCollections(db);
 	const { i18nEnabled, defaultLocale } = await detectLocaleInfo(db, seed.collections);
 	if (defaultLocale) seed.defaultLocale = defaultLocale;
@@ -1543,6 +1563,20 @@ async function exportSettings(db) {
 	}
 	return Object.keys(settings).length > 0 ? settings : void 0;
 }
+async function exportBlockTypes(db) {
+	return (await new BlockTypeRegistry(db).listBlockTypes()).map((blockType) => ({
+		slug: blockType.slug,
+		label: blockType.label,
+		description: blockType.description,
+		icon: blockType.icon,
+		category: blockType.category,
+		currentVersion: blockType.currentVersion,
+		versions: blockType.versions.map((version) => ({
+			version: version.version,
+			fields: version.fields
+		}))
+	}));
+}
 /**
 * Export collections and their fields
 */
@@ -1588,10 +1622,10 @@ async function exportCollections(db) {
 * Export taxonomy definitions and terms
 */
 async function exportTaxonomies(db, i18nEnabled) {
-	const defs = await db.selectFrom("_emdash_taxonomy_defs").selectAll().orderBy("name").orderBy("locale").execute();
+	const defs = await selectTaxonomyDefs(db).orderBy("d.name").orderBy("d.locale").execute();
 	const result = [];
 	const termRepo = new TaxonomyRepository(db);
-	const defGroupToSeedId = /* @__PURE__ */ new Map();
+	const anchorByName = /* @__PURE__ */ new Map();
 	for (const def of defs) {
 		const defSeedId = i18nEnabled && def.locale ? `tax:${def.name}:${def.locale}` : `tax:${def.name}`;
 		const terms = await termRepo.findByName(def.name, { locale: def.locale });
@@ -1623,17 +1657,17 @@ async function exportTaxonomies(db, i18nEnabled) {
 			id: defSeedId,
 			name: def.name,
 			label: def.label,
-			labelSingular: def.label_singular || void 0,
-			hierarchical: def.hierarchical === 1,
-			collections: def.collections ? JSON.parse(def.collections) : []
+			labelSingular: def.label_singular || void 0
 		};
 		if (i18nEnabled && def.locale) {
 			taxonomy.locale = def.locale;
-			if (def.translation_group) {
-				const anchor = defGroupToSeedId.get(def.translation_group);
-				if (anchor) taxonomy.translationOf = anchor;
-				else defGroupToSeedId.set(def.translation_group, defSeedId);
-			}
+			const anchor = anchorByName.get(def.name);
+			if (anchor) taxonomy.translationOf = anchor;
+			else anchorByName.set(def.name, defSeedId);
+		}
+		if (!taxonomy.translationOf) {
+			taxonomy.hierarchical = def.hierarchical === 1;
+			taxonomy.collections = parseTaxonomyCollections(def.collections);
 		}
 		if (seedTerms.length > 0) taxonomy.terms = seedTerms;
 		result.push(taxonomy);
@@ -3528,16 +3562,16 @@ function totalBundleBytes(entries) {
 function validateBundleSize(entries) {
 	const violations = [];
 	const total = totalBundleBytes(entries);
-	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`);
+	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes$1(total)} exceeds maximum of ${formatBytes$1(MAX_BUNDLE_SIZE)}.`);
 	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
 	const oversized = entries.filter((e) => e.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
-	for (const e of oversized) violations.push(`File ${e.name} is ${formatBytes(e.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`);
+	for (const e of oversized) violations.push(`File ${e.name} is ${formatBytes$1(e.bytes)}, exceeds per-file maximum of ${formatBytes$1(MAX_FILE_SIZE)}.`);
 	return violations;
 }
 /**
 * Render a byte count as a human-friendly string (e.g. "256.0 KB").
 */
-function formatBytes(n) {
+function formatBytes$1(n) {
 	if (n < 1024) return `${n} B`;
 	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
 	return `${(n / 1024 / 1024).toFixed(2)} MB`;
@@ -3892,7 +3926,7 @@ const bundleCommand = defineCommand({
 			if (sizeViolations.length > 0) {
 				for (const v of sizeViolations) consola.error(v);
 				hasErrors = true;
-			} else consola.info(`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
+			} else consola.info(`Bundle size: ${formatBytes$1(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
 			if (hasErrors) {
 				consola.error("Bundle validation failed");
 				process.exit(1);
@@ -5259,7 +5293,7 @@ const seedCommand = defineCommand({
 			if (result.settings.applied > 0) consola.info(`Settings: ${result.settings.applied} applied`);
 			if (result.collections.created > 0 || result.collections.skipped > 0 || result.collections.updated > 0) consola.info(`Collections: ${result.collections.created} created, ${result.collections.skipped} skipped, ${result.collections.updated} updated`);
 			if (result.fields.created > 0 || result.fields.skipped > 0 || result.fields.updated > 0) consola.info(`Fields: ${result.fields.created} created, ${result.fields.skipped} skipped, ${result.fields.updated} updated`);
-			if (result.taxonomies.created > 0 || result.taxonomies.terms > 0) consola.info(`Taxonomies: ${result.taxonomies.created} created, ${result.taxonomies.terms} terms`);
+			if (result.taxonomies.created > 0 || result.taxonomies.skipped > 0 || result.taxonomies.terms > 0) consola.info(`Taxonomies: ${result.taxonomies.created} created, ${result.taxonomies.skipped} skipped, ${result.taxonomies.terms} terms`);
 			if (result.bylines.created > 0 || result.bylines.skipped > 0 || result.bylines.updated > 0) consola.info(`Bylines: ${result.bylines.created} created, ${result.bylines.skipped} skipped, ${result.bylines.updated} updated`);
 			if (result.menus.created > 0 || result.menus.items > 0) consola.info(`Menus: ${result.menus.created} created, ${result.menus.items} items`);
 			if (result.widgetAreas.created > 0 || result.widgetAreas.widgets > 0) consola.info(`Widget Areas: ${result.widgetAreas.created} created, ${result.widgetAreas.widgets} widgets`);
@@ -5275,6 +5309,1386 @@ const seedCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/site/archive.ts
+/**
+* Reading and writing `.emdash` site package files on disk.
+*
+* Reading never trusts the archive: every entry is hashed and checked
+* against the manifest and the index chunks it pins before anything is
+* uploaded, so a damaged or tampered package fails locally.
+*/
+/** Split an index chunk into its entries. */
+function parseIndexChunk(bytes) {
+	const text = decodeUtf8(bytes, "TRANSFER_MANIFEST_INVALID");
+	if (text.length > 0 && !text.endsWith("\n")) throw new TransferError("TRANSFER_MANIFEST_INVALID", "Index chunk must end with a newline");
+	return text.split("\n").slice(0, -1).map((line) => parseIndexLine(line));
+}
+function openArchive(path) {
+	return Readable.toWeb(createReadStream(path));
+}
+async function readBody(body) {
+	return new Uint8Array(await new Response(body).arrayBuffer());
+}
+function mismatch(path, kind) {
+	return kind === "digest" ? new TransferError("TRANSFER_FILE_DIGEST_MISMATCH", "File does not match its digest", { detail: { path } }) : new TransferError("TRANSFER_FILE_SIZE_MISMATCH", "File does not have its declared size", { detail: { path } });
+}
+/** Check bytes against a declared size and digest. */
+async function assertFileMatches(path, bytes, expected) {
+	if (bytes.byteLength !== expected.bytes) throw mismatch(path, "size");
+	if (await sha256Hex(bytes) !== expected.sha256) throw mismatch(path, "digest");
+}
+async function hashBody(body) {
+	const hasher = await createSha256();
+	let bytes = 0;
+	await body.pipeTo(new WritableStream({ write(chunk) {
+		bytes += chunk.byteLength;
+		hasher.update(chunk);
+	} }));
+	return {
+		bytes,
+		sha256: await hasher.digest()
+	};
+}
+/** Whether the file at `diskPath` exists and has exactly the expected size and digest. */
+async function diskFileMatches(diskPath, expected) {
+	let info;
+	try {
+		info = await stat(diskPath);
+	} catch {
+		return false;
+	}
+	if (!info.isFile() || info.size !== expected.bytes) return false;
+	return (await hashBody(openArchive(diskPath))).sha256 === expected.sha256;
+}
+/**
+* Stream `body` to `diskPath`, verifying it against the package file `path`
+* declares. The file appears at `diskPath` only once it is complete and
+* verified.
+*/
+async function saveVerifiedFile(path, body, expected, diskPath) {
+	const temporary = `${diskPath}.download`;
+	const hasher = await createSha256();
+	let bytes = 0;
+	const verify = new TransformStream({ transform(chunk, controller) {
+		bytes += chunk.byteLength;
+		if (bytes > expected.bytes) throw mismatch(path, "size");
+		hasher.update(chunk);
+		controller.enqueue(chunk);
+	} });
+	try {
+		await body.pipeThrough(verify).pipeTo(Writable.toWeb(createWriteStream(temporary)));
+		if (bytes !== expected.bytes) throw mismatch(path, "size");
+		if (await hasher.digest() !== expected.sha256) throw mismatch(path, "digest");
+		await rename(temporary, diskPath);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+/**
+* Read a package file end to end and verify it: the manifest, every index
+* chunk the manifest pins, and every file the index lists, each by size and
+* SHA-256. Fails with a `TransferError` naming the first bad path.
+*/
+async function scanSitePackage(archivePath) {
+	let manifestBytes;
+	let manifest;
+	const indexRefs = /* @__PURE__ */ new Map();
+	const declared = /* @__PURE__ */ new Map();
+	const indexEntries = /* @__PURE__ */ new Map();
+	const indexOf = /* @__PURE__ */ new Map();
+	const seen = /* @__PURE__ */ new Map();
+	await unpackSitePackage(openArchive(archivePath), async (file) => {
+		if (file.parsed.type === "manifest") {
+			manifestBytes = await readBody(file.body);
+			manifest = parseManifest(manifestBytes);
+			for (const ref of manifest.index) indexRefs.set(ref.path, {
+				bytes: ref.bytes,
+				sha256: ref.sha256
+			});
+			return;
+		}
+		if (file.parsed.type === "index") {
+			const expected = indexRefs.get(file.path);
+			if (!expected) throw new TransferError("TRANSFER_FILE_NOT_DECLARED", "Index chunk is not listed", { detail: { path: file.path } });
+			if (file.bytes !== expected.bytes) throw mismatch(file.path, "size");
+			const bytes = await readBody(file.body);
+			await assertFileMatches(file.path, bytes, expected);
+			const paths = [];
+			for (const entry of parseIndexChunk(bytes)) {
+				if (declared.has(entry.path)) throw new TransferError("TRANSFER_MANIFEST_INVALID", "File is listed twice", { detail: { path: entry.path } });
+				declared.set(entry.path, {
+					bytes: entry.bytes,
+					sha256: entry.sha256
+				});
+				indexOf.set(entry.path, file.path);
+				paths.push(entry.path);
+			}
+			indexEntries.set(file.path, paths);
+			seen.set(file.path, expected);
+			return;
+		}
+		seen.set(file.path, await hashBody(file.body));
+	}, { expectedBytes: (path) => indexRefs.get(path)?.bytes ?? declared.get(path)?.bytes });
+	if (!manifest || !manifestBytes) throw new TransferError("TRANSFER_CONTAINER_INVALID", "The package has no manifest");
+	for (const [path, expected] of [...indexRefs, ...declared]) {
+		const actual = seen.get(path);
+		if (!actual) throw new TransferError("TRANSFER_FILE_MISSING", "The package is missing a file", { detail: { path } });
+		if (actual.bytes !== expected.bytes) throw mismatch(path, "size");
+		if (actual.sha256 !== expected.sha256) throw mismatch(path, "digest");
+	}
+	for (const path of seen.keys()) if (!indexRefs.has(path) && !declared.has(path)) throw new TransferError("TRANSFER_FILE_NOT_DECLARED", "File is not listed by the package", { detail: { path } });
+	let totalBytes = manifestBytes.byteLength;
+	for (const file of seen.values()) totalBytes += file.bytes;
+	return {
+		manifestBytes,
+		manifest,
+		packageDigest: await packageDigest(manifest),
+		files: seen,
+		indexEntries,
+		indexOf,
+		totalBytes
+	};
+}
+/**
+* Stream `files` into a package file at `outputPath`. Writes go to a
+* sibling `.partial` file that replaces `outputPath` only once the whole
+* archive is written; on failure the partial file is removed.
+*/
+async function writeSitePackage(outputPath, files) {
+	const partialPath = `${outputPath}.partial`;
+	let bytes = 0;
+	const counter = new TransformStream({ transform(chunk, controller) {
+		bytes += chunk.byteLength;
+		controller.enqueue(chunk);
+	} });
+	const sink = Writable.toWeb(createWriteStream(partialPath));
+	try {
+		await packSitePackage(files).pipeThrough(counter).pipeTo(sink);
+		await rename(partialPath, outputPath);
+	} catch (error) {
+		await rm(partialPath, { force: true });
+		throw error;
+	}
+	return { bytes };
+}
+
+//#endregion
+//#region src/cli/site/shared.ts
+/**
+* Shared pieces of `emdash site`: errors, their user-facing messages,
+* retries, and progress reporting.
+*/
+/** A failure the CLI reports with a stable code, like an API error. */
+var SiteTransferCliError = class extends Error {
+	constructor(code, message, details) {
+		super(message);
+		this.code = code;
+		this.details = details;
+		this.name = "SiteTransferCliError";
+	}
+};
+const TRANSFER_MESSAGES = {
+	TRANSFER_TARGET_NOT_EMPTY: "This site already has content. A site package can only be imported into an empty site.",
+	TRANSFER_IMPORT_IN_PROGRESS: "Another import is in progress on this site, or an unfinished import is still blocking writes. Check it with `emdash site import status <operation-id>`.",
+	TRANSFER_EXPORT_CONCURRENT_WRITES: "The site kept changing while it was being exported. Run the export again when the site is quiet.",
+	TRANSFER_OPERATION_NOT_FOUND: "No transfer operation with that id exists on this site.",
+	TRANSFER_EXPIRED: "This transfer has expired and its files were removed. Start a new export or import.",
+	TRANSFER_IDEMPOTENCY_CONFLICT: "This site already has an import started from a different package with the same key.",
+	TRANSFER_MANIFEST_INVALID: "The package manifest is invalid.",
+	TRANSFER_UNSUPPORTED_FORMAT: "This package uses a format version this site does not support. Upgrade EmDash on this site.",
+	TRANSFER_UNSUPPORTED_FEATURE: "This package needs features this site does not support. Upgrade EmDash on this site.",
+	TRANSFER_CONTAINER_INVALID: "The file is not a valid .emdash site package.",
+	TRANSFER_FILE_DIGEST_MISMATCH: "A package file does not match its recorded digest. The package is damaged or was modified.",
+	TRANSFER_FILE_SIZE_MISMATCH: "A package file does not have its recorded size. The package is damaged or was modified.",
+	TRANSFER_FILE_MISSING: "The package is missing files its manifest lists.",
+	TRANSFER_FILE_NOT_DECLARED: "The package contains a file its manifest does not list.",
+	TRANSFER_LIMIT_EXCEEDED: "The package exceeds a limit this site enforces.",
+	TRANSFER_PACKAGE_DIGEST_MISMATCH: "This is not the package that was analyzed. Analyze this package with `--analyze` first.",
+	TRANSFER_PLAN_DIGEST_MISMATCH: "The plan changed since it was reviewed. Run `emdash site import <file> --analyze` again and confirm the new plan digest.",
+	TRANSFER_PLAN_BLOCKED: "The import plan has blockers. Run `emdash site import <file> --analyze` to see them.",
+	TRANSFER_DECISIONS_INVALID: "The import decisions are invalid.",
+	TRANSFER_VERIFICATION_FAILED: "The imported site did not verify against the package, so no receipt was issued. Do not use this site; import into a fresh one."
+};
+const TRANSFORMATION_LABELS = {
+	soft_orphan_dropped: "Unused references were left out",
+	avatar_nulled: "Some byline avatars were left out",
+	redirect_duplicate_dropped: "Duplicate redirects were left out",
+	media_not_ready_dropped: "Unfinished media uploads were left out",
+	media_url_relativized: "Media links were made relative",
+	orphan_dropped: "Records without a parent were left out",
+	orphan_reference_nulled: "Broken references were cleared",
+	media_ref_unlinked: "Some media links could not be matched to files",
+	unknown_storage_key: "Some content links to media files the source site doesn't have; those links won't work",
+	principal_mapped: "Authors will be assigned to users on this site",
+	principal_unmapped: "Some content will have no author",
+	seeded_scaffold_removed: "Starter content will be removed",
+	redirect_loop_disabled: "Redirects that loop will be imported turned off",
+	search_unsupported: "Search will be turned off for some collections",
+	float4_rounded: "Some decimal numbers will be rounded",
+	locale_recased: "Locales will use this site's capitalization"
+};
+/** A plain-language description of a plan transformation code. */
+function transformationLabel(code) {
+	const labels = TRANSFORMATION_LABELS;
+	return (Object.hasOwn(labels, code) ? labels[code] : void 0) ?? code;
+}
+function withServerDetail(friendly, serverMessage) {
+	return serverMessage && !friendly.includes(serverMessage) ? `${friendly} (${serverMessage})` : friendly;
+}
+/** The code and user-facing message for any error `emdash site` can hit. */
+function describeError(error) {
+	if (error instanceof EmDashApiError) {
+		const friendly = TRANSFER_MESSAGES[error.code];
+		return {
+			code: error.code,
+			message: friendly ? withServerDetail(friendly, error.message) : error.message
+		};
+	}
+	if (error instanceof SiteTransferCliError) return {
+		code: error.code,
+		message: error.message
+	};
+	if (isTransferError(error)) {
+		const friendly = TRANSFER_MESSAGES[error.code];
+		const path = typeof error.detail?.path === "string" ? ` [${error.detail.path}]` : "";
+		return {
+			code: error.code,
+			message: `${friendly ? withServerDetail(friendly, error.message) : error.message}${path}`
+		};
+	}
+	return {
+		code: "UNKNOWN_ERROR",
+		message: error instanceof Error ? error.message : String(error)
+	};
+}
+/** Describe a failed operation from its recorded error. */
+function operationError(operation) {
+	const code = operation.errorCode ?? "TRANSFER_OPERATION_FAILED";
+	const friendly = TRANSFER_MESSAGES[code];
+	const base = friendly ?? `Operation ${operation.id} ended as ${operation.state}.`;
+	return new SiteTransferCliError(code, friendly ? `${base} (operation ${operation.id} is ${operation.state})` : base, operation.errorDetail ?? void 0);
+}
+function sleepFor(runtime, ms) {
+	if (ms <= 0) return Promise.resolve();
+	if (runtime.sleep) return runtime.sleep(ms);
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const MAX_BACKOFF_MS = 8e3;
+/** Network failures, timeouts, rate limits, and server errors are worth another try. */
+function isTransient(error) {
+	if (error instanceof EmDashApiError) {
+		if (error.code === "TRANSFER_IMPORT_IN_PROGRESS") return false;
+		return error.status === 408 || error.status === 429 || error.status >= 500;
+	}
+	if (error instanceof SiteTransferCliError || isTransferError(error)) return false;
+	return error instanceof TypeError || error instanceof Error && error.name === "AbortError";
+}
+/** Run `fn`, retrying transient failures with exponential backoff. */
+async function withRetry(runtime, label, fn) {
+	const attempts = runtime.retry?.attempts ?? 5;
+	const base = runtime.retry?.baseDelayMs ?? 500;
+	for (let attempt = 1;; attempt++) try {
+		return await fn();
+	} catch (error) {
+		if (attempt >= attempts || !isTransient(error)) throw error;
+		const delay = Math.min(base * 2 ** (attempt - 1), MAX_BACKOFF_MS);
+		runtime.reporter.warn(`${label} failed (${describeError(error).message}); retrying in ${Math.round(delay / 100) / 10}s`);
+		await sleepFor(runtime, delay);
+	}
+}
+/** Emits a progress line at most once per interval, and always when the label changes. */
+function createProgressLogger(runtime, intervalMs = 2e3) {
+	let lastLabel;
+	let lastAt = 0;
+	return (label, detail) => {
+		const now = Date.now();
+		if (label === lastLabel && now - lastAt < intervalMs) return;
+		lastLabel = label;
+		lastAt = now;
+		runtime.reporter.info(detail ? `${label}: ${detail}` : label);
+	};
+}
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	const units = [
+		"KiB",
+		"MiB",
+		"GiB",
+		"TiB"
+	];
+	let value = bytes / 1024;
+	let unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit++;
+	}
+	return `${value.toFixed(1)} ${units[unit]}`;
+}
+function formatProgress(progress) {
+	if (!progress) return void 0;
+	const bytes = progress.bytesTotal !== void 0 && progress.bytesDone !== void 0 ? ` (${formatBytes(progress.bytesDone)} / ${formatBytes(progress.bytesTotal)})` : "";
+	return `${progress.done}/${progress.total}${bytes}`;
+}
+
+//#endregion
+//#region src/cli/site/export.ts
+/**
+* `emdash site export`: drive a server-side export to completion, then
+* download its files one by one and assemble the `.emdash` package locally.
+*
+* A sidecar `<output>.partial.json` holds the idempotency key and operation
+* id, so re-running the same command after a crash or disconnect resumes the
+* same export instead of starting another. Downloaded files are kept in
+* `<output>.parts/` until the package is assembled, so a re-run only
+* downloads the files it does not have yet.
+*/
+const DOWNLOAD_CONCURRENCY = 4;
+const sidecarSchema = z.object({
+	version: z.literal(1),
+	baseUrl: z.string(),
+	comments: z.boolean(),
+	idempotencyKey: z.string(),
+	operationId: z.string().nullable()
+});
+function exportSidecarPath(outputPath) {
+	return `${outputPath}.partial.json`;
+}
+async function readSidecar(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		const parsed = sidecarSchema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+async function writeSidecar(path, sidecar) {
+	await writeFile(path, `${JSON.stringify(sidecar, null, "	")}\n`);
+}
+async function startOrResume(input, runtime) {
+	const sidecarPath = exportSidecarPath(input.outputPath);
+	let sidecar = await readSidecar(sidecarPath);
+	if (sidecar && (sidecar.baseUrl !== input.baseUrl || sidecar.comments !== input.comments)) {
+		runtime.reporter.warn(`Ignoring ${sidecarPath}: it belongs to an export with different options or from another site.`);
+		sidecar = null;
+	}
+	if (sidecar?.operationId) {
+		const operationId = sidecar.operationId;
+		const operation = (await withRetry(runtime, "Reading the export", () => input.client.transferExportGet(operationId)).catch((error) => {
+			if (error instanceof EmDashApiError && error.code === "TRANSFER_OPERATION_NOT_FOUND") return null;
+			throw error;
+		}))?.operation;
+		if (operation && operation.state !== "failed" && operation.state !== "expired") {
+			if (operation.state !== "complete" || operation.stagingCollectedAt === null) {
+				runtime.reporter.info(`Resuming export ${operation.id}`);
+				return {
+					operation,
+					resumed: true
+				};
+			}
+		}
+		runtime.reporter.warn(operation ? `Export ${operation.id} ${operation.state === "failed" ? `failed (${operation.errorCode ?? "unknown error"})` : "expired"}; starting a new export.` : `Export ${operationId} no longer exists; starting a new export.`);
+		sidecar = null;
+	}
+	const state = sidecar ?? {
+		version: 1,
+		baseUrl: input.baseUrl,
+		comments: input.comments,
+		idempotencyKey: `emdash-cli-export-${ulid()}`,
+		operationId: null
+	};
+	await writeSidecar(sidecarPath, state);
+	const created = await withRetry(runtime, "Starting the export", () => input.client.transferExportCreate(input.comments ? {} : { comments: false }, { idempotencyKey: state.idempotencyKey }));
+	await writeSidecar(sidecarPath, {
+		...state,
+		operationId: created.operation.id
+	});
+	runtime.reporter.info(`${created.created ? "Started" : "Resuming"} export ${created.operation.id}`);
+	return {
+		operation: created.operation,
+		resumed: !created.created
+	};
+}
+/** Advance an export until it ends; returns the complete operation. */
+async function driveExport(client, operation, runtime) {
+	const progress = createProgressLogger(runtime);
+	let current = operation;
+	while (current.state === "pending" || current.state === "running") {
+		const step = await withRetry(runtime, "Export step", () => client.transferExportAdvance(current.id));
+		current = step.operation;
+		progress(`Exporting (${current.stage ?? current.state})`, formatProgress(current.progress));
+		if (step.nextRequestInMs === null) break;
+		await sleepFor(runtime, step.nextRequestInMs);
+	}
+	if (current.state !== "complete") throw operationError(current);
+	return current;
+}
+/**
+* Directory next to the output where downloaded files are kept, by digest,
+* until the package is assembled. A re-run reuses every file there that
+* still verifies.
+*/
+function exportPartsPath(outputPath) {
+	return `${outputPath}.parts`;
+}
+/**
+* Run `task` over `items` with at most `limit` in flight. After a failure no
+* new item starts, the ones in flight finish, and the first failure is
+* thrown.
+*/
+async function forEachConcurrently(items, limit, task) {
+	let next = 0;
+	let failure;
+	const worker = async () => {
+		while (!failure && next < items.length) {
+			const item = items[next++];
+			try {
+				await task(item);
+			} catch (error) {
+				failure ??= { error };
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+	if (failure) throw failure.error;
+}
+/**
+* Download a complete export file by file and write it as a package file.
+* The manifest must hash to the export's package digest.
+*/
+async function downloadExport(client, operation, outputPath, runtime) {
+	const operationId = operation.id;
+	const manifestBytes = await withRetry(runtime, "Downloading the manifest", () => client.transferExportManifest(operationId));
+	const manifest = parseManifest(manifestBytes);
+	const digest = await packageDigest(manifest);
+	if (digest !== operation.packageDigest) throw new SiteTransferCliError("TRANSFER_PACKAGE_DIGEST_MISMATCH", `The downloaded manifest does not match export ${operationId}. Run the export again.`);
+	const partsDir = exportPartsPath(outputPath);
+	await mkdir(partsDir, { recursive: true });
+	const partOf = (file) => join(partsDir, file.sha256);
+	let kept = 0;
+	const fetchPart = async (file) => {
+		if (await diskFileMatches(partOf(file), file)) {
+			kept++;
+			return;
+		}
+		await withRetry(runtime, `Downloading ${file.path}`, async () => {
+			const download = await client.transferExportFile(operationId, file.path);
+			await saveVerifiedFile(file.path, download.body, file, partOf(file));
+		});
+	};
+	const indexChunks = manifest.index.map((ref) => ({
+		path: ref.path,
+		bytes: ref.bytes,
+		sha256: ref.sha256
+	}));
+	const entries = [];
+	for (const chunk of indexChunks) {
+		await fetchPart(chunk);
+		entries.push(...parseIndexChunk(await readFile(partOf(chunk))));
+	}
+	const unique = [...new Map(entries.map((entry) => [entry.sha256, entry])).values()];
+	const total = unique.reduce((sum, entry) => sum + entry.bytes, 0);
+	const progress = createProgressLogger(runtime);
+	let done = 0;
+	let count = 0;
+	await forEachConcurrently(unique, DOWNLOAD_CONCURRENCY, async (entry) => {
+		await fetchPart(entry);
+		done += entry.bytes;
+		count++;
+		progress("Downloading", `${count}/${unique.length} files (${formatBytes(done)} / ${formatBytes(total)})`);
+	});
+	if (kept > 0) runtime.reporter.info(`Reused ${kept} files downloaded by an earlier run`);
+	async function* files() {
+		yield {
+			path: MANIFEST_PATH,
+			bytes: manifestBytes.byteLength,
+			body: () => manifestBytes
+		};
+		for (const file of [...indexChunks, ...entries]) yield {
+			path: file.path,
+			bytes: file.bytes,
+			body: () => openArchive(partOf(file))
+		};
+	}
+	const written = await writeSitePackage(outputPath, files());
+	await rm(partsDir, {
+		recursive: true,
+		force: true
+	});
+	return {
+		packageDigest: digest,
+		files: 1 + indexChunks.length + entries.length,
+		bytes: written.bytes
+	};
+}
+async function runSiteExport(input, runtime) {
+	const { operation, resumed } = await startOrResume(input, runtime);
+	const complete = await driveExport(input.client, operation, runtime);
+	runtime.reporter.info(`Export ${complete.id} is complete; downloading`);
+	const downloaded = await downloadExport(input.client, complete, input.outputPath, runtime);
+	await rm(exportSidecarPath(input.outputPath), { force: true });
+	return {
+		operationId: complete.id,
+		output: input.outputPath,
+		packageDigest: downloaded.packageDigest,
+		files: downloaded.files,
+		bytes: downloaded.bytes,
+		resumed
+	};
+}
+
+//#endregion
+//#region src/cli/site/import.ts
+/**
+* `emdash site import`: verify a local package, upload what the target is
+* missing, analyze it into a plan, and execute a confirmed plan.
+*
+* Every step is resumable. The import is created with the package digest as
+* its idempotency key and found again by digest, uploads skip files the
+* target already verified, and analysis and execution are server-side state
+* machines the CLI only advances.
+*/
+const UPLOAD_CONCURRENCY = 4;
+/** Buffered upload bytes allowed in flight; one larger file may exceed it. */
+const UPLOAD_BUFFER_BYTES = 64 * 1024 * 1024;
+const MISSING_PAGE = 100;
+const IMPORT_LOOKUP_PAGES = 5;
+const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const ENDED_WITHOUT_RECEIPT = new Set([
+	"failed",
+	"cancelled",
+	"abandoned",
+	"expired"
+]);
+/** Whether an import is executing: requested (`planned` at stage `reserve`), running, or verifying. */
+function isExecuting(operation) {
+	return operation.state === "running" || operation.state === "verifying" || operation.state === "planned" && operation.stage === "reserve";
+}
+/** Normalize a plan digest given as `sha256:<hex>` or bare hex. */
+function normalizePlanDigest(value) {
+	const trimmed = value.trim().toLowerCase();
+	if (SHA256_DIGEST_PATTERN.test(trimmed)) return trimmed;
+	if (SHA256_HEX_PATTERN.test(trimmed)) return `sha256:${trimmed}`;
+	throw new SiteTransferCliError("INVALID_ARGUMENT", "--plan must be a plan digest like sha256:<64 hex characters>");
+}
+async function findImportByDigest(client, digest, runtime) {
+	let cursor;
+	for (let page = 0; page < IMPORT_LOOKUP_PAGES; page++) {
+		const result = await withRetry(runtime, "Listing imports", () => client.transferImportList({
+			limit: 100,
+			cursor
+		}));
+		const match = result.items.find((item) => item.packageDigest === digest);
+		if (match) return ENDED_WITHOUT_RECEIPT.has(match.state) ? null : match;
+		if (!result.nextCursor) return null;
+		cursor = result.nextCursor;
+	}
+	return null;
+}
+/** Import states that keep blocking site writes once the import has written. */
+const BLOCKING_AFTER_WRITE = new Set(["failed", "cancelled"]);
+function occupiesTarget(operation) {
+	if (!ENDED_WITHOUT_RECEIPT.has(operation.state) && operation.state !== "complete") return true;
+	return operation.mutationStartedAt !== null && BLOCKING_AFTER_WRITE.has(operation.state);
+}
+/**
+* When the site refuses a new import because an earlier import wrote to it
+* and then stopped, say which import and what to do about it; otherwise
+* return `error` unchanged.
+*/
+async function explainOccupiedTarget(client, error, runtime) {
+	if (!(error instanceof EmDashApiError) || error.code !== "TRANSFER_TARGET_NOT_EMPTY" && error.code !== "TRANSFER_IMPORT_IN_PROGRESS") return error;
+	const { items } = await withRetry(runtime, "Listing imports", () => client.transferImportList({ limit: 100 })).catch(() => ({ items: [] }));
+	const occupying = items.find(occupiesTarget);
+	if (occupying) {
+		if (!BLOCKING_AFTER_WRITE.has(occupying.state)) return error;
+		const ended = occupying.state === "failed" ? "failed" : "was cancelled";
+		return new SiteTransferCliError(error.code, `Import ${occupying.id} ${ended} after it started writing, so this site holds partial data from it and blocks writes. Abandon it with \`emdash site import abandon ${occupying.id}\`, then reset this site or set up a new one before importing again.`, {
+			operationId: occupying.id,
+			state: occupying.state
+		});
+	}
+	const abandoned = items.find((item) => item.state === "abandoned" && item.mutationStartedAt !== null);
+	if (error.code === "TRANSFER_TARGET_NOT_EMPTY" && abandoned) return new SiteTransferCliError(error.code, `Import ${abandoned.id} wrote partial data to this site before it was abandoned. Reset this site or set up a new one before importing again.`, {
+		operationId: abandoned.id,
+		state: abandoned.state
+	});
+	return error;
+}
+/**
+* Find the import of this package on the target, or create it. An earlier
+* import of the same package that ended without a receipt is left alone and
+* a new one is started.
+*/
+async function openImport(client, scan, runtime) {
+	const existing = await findImportByDigest(client, scan.packageDigest, runtime);
+	if (existing) {
+		runtime.reporter.info(`Resuming import ${existing.id} (${existing.state})`);
+		return {
+			operation: existing,
+			fresh: false
+		};
+	}
+	const create = (idempotencyKey) => withRetry(runtime, "Creating the import", () => client.transferImportCreate(scan.manifestBytes, { idempotencyKey })).catch(async (error) => {
+		throw await explainOccupiedTarget(client, error, runtime);
+	});
+	let created = await create(scan.packageDigest);
+	if (ENDED_WITHOUT_RECEIPT.has(created.operation.state)) {
+		runtime.reporter.warn(`An earlier import of this package (${created.operation.id}) ended as ${created.operation.state}; starting a new one.`);
+		created = await create(`${scan.packageDigest}/${Date.now().toString(36)}`);
+	}
+	runtime.reporter.info(`${created.created ? "Created" : "Resuming"} import ${created.operation.id} (${created.operation.state})`);
+	return {
+		operation: created.operation,
+		fresh: created.created
+	};
+}
+async function listMissing(client, operationId, runtime) {
+	const files = [];
+	let cursor;
+	do {
+		const page = await withRetry(runtime, "Listing missing files", () => client.transferImportMissing(operationId, {
+			limit: MISSING_PAGE,
+			cursor
+		}));
+		files.push(...page.items);
+		cursor = page.nextCursor;
+	} while (cursor);
+	return files;
+}
+var UploadPool = class {
+	inFlight = /* @__PURE__ */ new Set();
+	bytes = 0;
+	failure;
+	constructor(concurrency, maxBytes) {
+		this.concurrency = concurrency;
+		this.maxBytes = maxBytes;
+	}
+	async add(size, task) {
+		while (this.inFlight.size > 0 && (this.inFlight.size >= this.concurrency || this.bytes + size > this.maxBytes)) await Promise.race(this.inFlight);
+		this.rethrow();
+		this.bytes += size;
+		const promise = task().catch((error) => {
+			this.failure ??= error;
+		}).finally(() => {
+			this.bytes -= size;
+			this.inFlight.delete(promise);
+		});
+		this.inFlight.add(promise);
+	}
+	async drain() {
+		await Promise.all(this.inFlight);
+		this.rethrow();
+	}
+	/** Wait for uploads in flight without surfacing their failures. */
+	async settle() {
+		await Promise.allSettled(this.inFlight);
+	}
+	rethrow() {
+		if (this.failure !== void 0) throw this.failure;
+	}
+};
+/**
+* Upload every package file the import has not verified yet. Index chunks go
+* first because uploading one declares the files it lists; a file whose
+* index chunk is not uploaded yet waits for the next pass over the archive.
+*/
+async function uploadPackage(client, archivePath, scan, operation, runtime) {
+	const operationId = operation.operation.id;
+	const progress = createProgressLogger(runtime);
+	const summary = {
+		uploaded: 0,
+		bytes: 0
+	};
+	let pending = operation.fresh ? new Set(scan.files.keys()) : null;
+	for (;;) {
+		if (!pending) {
+			const missing = await listMissing(client, operationId, runtime);
+			for (const file of missing) {
+				const local = scan.files.get(file.path);
+				if (!local) throw new SiteTransferCliError("TRANSFER_FILE_MISSING", `The site expects ${file.path}, which is not in this package file`);
+				if (local.bytes !== file.bytes || local.sha256 !== file.sha256) throw new SiteTransferCliError("TRANSFER_FILE_DIGEST_MISMATCH", `The site expects different contents for ${file.path}`);
+			}
+			pending = new Set(missing.map((file) => file.path));
+			for (const file of missing) for (const path of scan.indexEntries.get(file.path) ?? []) pending.add(path);
+		}
+		if (pending.size === 0) return summary;
+		const total = pending.size;
+		const uploadedIndexes = /* @__PURE__ */ new Set();
+		const pool = new UploadPool(UPLOAD_CONCURRENCY, UPLOAD_BUFFER_BYTES);
+		let passUploaded = 0;
+		const upload = async (path, bytes) => {
+			await withRetry(runtime, `Uploading ${path}`, () => client.transferImportUploadFile(operationId, path, bytes, bytes.byteLength));
+			passUploaded++;
+			summary.uploaded++;
+			summary.bytes += bytes.byteLength;
+			progress("Uploading", `${passUploaded}/${total} files (${formatBytes(summary.bytes)} this run)`);
+		};
+		const passPending = pending;
+		try {
+			await unpackSitePackage(openArchive(archivePath), async (file) => {
+				if (!passPending.has(file.path)) return;
+				const index = scan.indexOf.get(file.path);
+				if (index && passPending.has(index) && !uploadedIndexes.has(index)) return;
+				const expected = scan.files.get(file.path);
+				if (!expected) return;
+				const bytes = await readBody(file.body);
+				await assertFileMatches(file.path, bytes, expected);
+				if (file.parsed.type === "index") {
+					await upload(file.path, bytes);
+					uploadedIndexes.add(file.path);
+					return;
+				}
+				await pool.add(bytes.byteLength, () => upload(file.path, bytes));
+			});
+		} catch (error) {
+			await pool.settle();
+			throw error;
+		}
+		await pool.drain();
+		if (passUploaded === 0) throw new SiteTransferCliError("TRANSFER_FILE_MISSING", "The site still expects files that could not be uploaded from this package");
+		pending = null;
+	}
+}
+/** Advance analysis until the import is planned. */
+async function driveAnalysis(client, operation, runtime) {
+	const progress = createProgressLogger(runtime);
+	for (;;) {
+		const step = await withRetry(runtime, "Analysis step", () => client.transferImportAnalyze(operation.id)).catch(async (error) => {
+			if (error instanceof EmDashApiError && error.code === "TRANSFER_INVALID_STATE") {
+				const { operation: current } = await client.transferImportGet(operation.id);
+				if (ENDED_WITHOUT_RECEIPT.has(current.state)) throw operationError(current);
+			}
+			throw error;
+		});
+		const current = step.operation;
+		if (step.nextRequestInMs === null) {
+			if (current.state !== "planned" || !step.plan || !step.planDigest) throw operationError(current);
+			return {
+				operation: current,
+				plan: step.plan,
+				planDigest: step.planDigest
+			};
+		}
+		progress(`Analyzing (${current.stage ?? current.state})`, formatProgress(current.progress));
+		await sleepFor(runtime, step.nextRequestInMs);
+	}
+}
+/** Submit decisions for a planned import; returns the resulting plan. */
+async function applyDecisions(client, operationId, decisions, runtime) {
+	const decided = await withRetry(runtime, "Applying decisions", () => client.transferImportAnalyze(operationId, decisions));
+	if (!decided.plan || !decided.planDigest) throw operationError(decided.operation);
+	return {
+		operation: decided.operation,
+		plan: decided.plan,
+		planDigest: decided.planDigest
+	};
+}
+function hasDecisions(flags) {
+	return flags.mapPrincipal.length > 0 || flags.useTargetTitle || flags.useTargetTagline;
+}
+const USER_PAGES = 50;
+async function targetUsersByEmail(client, runtime) {
+	const byEmail = /* @__PURE__ */ new Map();
+	let cursor;
+	for (let page = 0; page < USER_PAGES; page++) {
+		const result = await withRetry(runtime, "Listing users", () => client.users({
+			limit: 100,
+			cursor
+		}));
+		for (const user of result.items) {
+			const key = user.email.toLowerCase();
+			byEmail.set(key, [...byEmail.get(key) ?? [], user.id]);
+		}
+		if (!result.nextCursor) break;
+		cursor = result.nextCursor;
+	}
+	return byEmail;
+}
+/**
+* Turn decision flags into plan decisions. Principals are matched by id, or
+* by email (case-insensitive); target users by id, by email through the
+* users API, or `none` to leave the references unassigned.
+*/
+async function resolveDecisions(client, plan, flags, runtime) {
+	const decisions = {};
+	if (flags.useTargetTitle) decisions.siteTitle = "target";
+	if (flags.useTargetTagline) decisions.siteTagline = "target";
+	if (flags.mapPrincipal.length === 0) return decisions;
+	let users;
+	const mappings = {};
+	for (const raw of flags.mapPrincipal) {
+		const separator = raw.lastIndexOf("=");
+		const from = separator > 0 ? raw.slice(0, separator).trim() : "";
+		const to = separator > 0 ? raw.slice(separator + 1).trim() : "";
+		if (!from || !to) throw new SiteTransferCliError("INVALID_ARGUMENT", `--map-principal expects <principal id or email>=<user id, email, or none>, got "${raw}"`);
+		const principal = plan.principals.find((candidate) => candidate.id === from) ?? matchOne(plan.principals.filter((candidate) => candidate.email?.toLowerCase() === from.toLowerCase()), `principal ${from}`);
+		if (!principal) throw new SiteTransferCliError("INVALID_ARGUMENT", `The package has no principal ${from}. Principals: ${plan.principals.map((p) => p.id).join(", ") || "none"}`);
+		let target;
+		if (to.toLowerCase() === "none") target = null;
+		else if (to.includes("@")) {
+			users ??= await targetUsersByEmail(client, runtime);
+			const ids = users.get(to.toLowerCase()) ?? [];
+			if (ids.length !== 1) throw new SiteTransferCliError("INVALID_ARGUMENT", ids.length === 0 ? `No user on this site has the email ${to}` : `More than one user on this site has the email ${to}; map by user id instead`);
+			target = ids[0];
+		} else target = to;
+		mappings[principal.id] = target;
+	}
+	decisions.principalMappings = mappings;
+	return decisions;
+}
+function matchOne(matches, label) {
+	if (matches.length > 1) throw new SiteTransferCliError("INVALID_ARGUMENT", `More than one ${label} matches; map by principal id instead`);
+	return matches[0];
+}
+/** Advance an executing import until it ends; returns the complete operation. */
+async function driveExecution(client, operation, runtime) {
+	const progress = createProgressLogger(runtime);
+	let current = operation;
+	while (isExecuting(current)) {
+		const step = await withRetry(runtime, "Import step", () => client.transferImportAdvance(current.id));
+		current = step.operation;
+		progress(`Importing (${current.stage ?? current.state})`, formatProgress(current.progress));
+		if (step.nextRequestInMs === null) break;
+		await sleepFor(runtime, step.nextRequestInMs);
+	}
+	if (current.state !== "complete") throw operationError(current);
+	return current;
+}
+async function fetchReceipt(client, operationId, runtime) {
+	const { receipt } = await withRetry(runtime, "Reading the receipt", () => client.transferImportReceipt(operationId));
+	return {
+		operationId,
+		state: "complete",
+		receipt,
+		receiptDigestValid: await verifyReceiptDigest(receipt)
+	};
+}
+/**
+* Execute a planned import after checking the reviewed plan digest, then
+* advance it to completion.
+*/
+async function executeImport(client, operation, planDigest, runtime) {
+	let current = operation;
+	if (current.planDigest !== planDigest) throw new SiteTransferCliError("TRANSFER_PLAN_DIGEST_MISMATCH", `The plan changed since it was reviewed: the current plan digest is ${current.planDigest ?? "none"}. Run with --analyze again and confirm the new digest.`);
+	if (current.state === "planned" && current.stage !== "reserve") {
+		if (!current.packageDigest) throw operationError(current);
+		const packageDigest = current.packageDigest;
+		current = (await withRetry(runtime, "Starting the import", () => client.transferImportExecute(current.id, {
+			packageDigest,
+			planDigest
+		}))).operation;
+		runtime.reporter.info(`Executing import ${current.id}`);
+	}
+	return fetchReceipt(client, (await driveExecution(client, current, runtime)).id, runtime);
+}
+/** Scan, upload, and analyze a package, applying any decisions. */
+async function analyzePackage(client, archivePath, flags, runtime) {
+	const { scan, opened } = await prepareImport(client, archivePath, runtime);
+	return continueToPlan(client, archivePath, scan, opened, flags, runtime);
+}
+async function prepareImport(client, archivePath, runtime) {
+	runtime.reporter.info(`Verifying ${archivePath}`);
+	const scan = await scanSitePackage(archivePath);
+	runtime.reporter.info(`Package ${scan.packageDigest}: ${scan.files.size + 1} files, ${formatBytes(scan.totalBytes)}`);
+	return {
+		scan,
+		opened: await openImport(client, scan, runtime)
+	};
+}
+async function continueToPlan(client, archivePath, scan, opened, flags, runtime) {
+	const operation = opened.operation;
+	if (isExecuting(operation)) return { operation };
+	switch (operation.state) {
+		case "uploading": {
+			if (!archivePath || !scan) throw new SiteTransferCliError("PACKAGE_FILE_REQUIRED", `Import ${operation.id} is still uploading. Pass the package file to resume it: emdash site import resume ${operation.id} <file>`);
+			const uploaded = await uploadPackage(client, archivePath, scan, opened, runtime);
+			runtime.reporter.info(`Uploaded ${uploaded.uploaded} files (${formatBytes(uploaded.bytes)})`);
+			return planWithDecisions(client, operation, flags, runtime);
+		}
+		case "analyzing":
+		case "planned": return planWithDecisions(client, operation, flags, runtime);
+		case "complete":
+			runtime.reporter.info(`Import ${operation.id} is already complete`);
+			return fetchReceipt(client, operation.id, runtime);
+		default: return { operation };
+	}
+}
+async function planWithDecisions(client, operation, flags, runtime) {
+	let planned = await driveAnalysis(client, operation, runtime);
+	if (hasDecisions(flags)) {
+		const decisions = await resolveDecisions(client, planned.plan, flags, runtime);
+		planned = await applyDecisions(client, planned.operation.id, decisions, runtime);
+	}
+	return {
+		...planned,
+		packageDigest: planned.plan.packageDigest
+	};
+}
+/** Scan, upload, and analyze if needed, then execute the confirmed plan. */
+async function confirmPackage(client, archivePath, planDigest, runtime) {
+	const { scan, opened } = await prepareImport(client, archivePath, runtime);
+	return confirmOperation(client, archivePath, scan, opened, planDigest, runtime);
+}
+async function confirmOperation(client, archivePath, scan, opened, planDigest, runtime) {
+	const operation = opened.operation;
+	if (operation.state === "complete") {
+		if (operation.planDigest !== planDigest) throw new SiteTransferCliError("TRANSFER_PLAN_DIGEST_MISMATCH", `Import ${operation.id} already completed with a different plan (${operation.planDigest ?? "none"})`);
+		return fetchReceipt(client, operation.id, runtime);
+	}
+	if (isExecuting(operation)) return executeImport(client, operation, planDigest, runtime);
+	const outcome = await continueToPlan(client, archivePath, scan, opened, {
+		mapPrincipal: [],
+		useTargetTitle: false,
+		useTargetTagline: false
+	}, runtime);
+	if (!("plan" in outcome)) {
+		if ("receipt" in outcome) return outcome;
+		throw operationError(outcome.operation);
+	}
+	if (outcome.plan.blockers.length > 0) throw new SiteTransferCliError("TRANSFER_PLAN_BLOCKED", `The import plan has ${outcome.plan.blockers.length} blocker(s). Run with --analyze to see them.`);
+	return executeImport(client, outcome.operation, planDigest, runtime);
+}
+async function importStatus(client, operationId, runtime) {
+	return withRetry(runtime, "Reading the import", () => client.transferImportGet(operationId));
+}
+/**
+* Continue an import from whatever state it is in: upload what is missing
+* (needs the package file), finish analysis, or finish execution.
+*/
+async function resumeImport(client, operationId, archivePath, runtime) {
+	const { operation } = await importStatus(client, operationId, runtime);
+	if (isExecuting(operation)) return fetchReceipt(client, (await driveExecution(client, operation, runtime)).id, runtime);
+	let scan = null;
+	if (operation.state === "uploading" && archivePath) {
+		runtime.reporter.info(`Verifying ${archivePath}`);
+		scan = await scanSitePackage(archivePath);
+		if (scan.packageDigest !== operation.packageDigest) throw new SiteTransferCliError("TRANSFER_PACKAGE_DIGEST_MISMATCH", `${archivePath} is not the package import ${operation.id} was created from`);
+	}
+	return continueToPlan(client, archivePath, scan, {
+		operation,
+		fresh: false
+	}, {
+		mapPrincipal: [],
+		useTargetTitle: false,
+		useTargetTagline: false
+	}, runtime);
+}
+async function importReceipt(client, operationId, runtime) {
+	return fetchReceipt(client, operationId, runtime);
+}
+/**
+* Resolve a refused cancel or abandon: a retry of a request whose response
+* was lost finds the import already in `state`.
+*/
+async function settledAs(client, operationId, error, state, runtime) {
+	if (!(error instanceof EmDashApiError) || error.code !== "TRANSFER_INVALID_STATE") throw error;
+	const { operation } = await importStatus(client, operationId, runtime);
+	if (operation.state === state) return operation;
+	throw new SiteTransferCliError("TRANSFER_INVALID_STATE", state === "abandoned" ? `Only a failed or cancelled import can be abandoned; import ${operationId} is ${operation.state}.` : `Import ${operationId} has already ended as ${operation.state}.`);
+}
+/**
+* Cancel an import. An import no request is working on is cancelled at
+* once; one mid-step stops after its current batch.
+*/
+async function cancelImport(client, operationId, runtime) {
+	return withRetry(runtime, "Cancelling the import", () => client.transferImportCancel(operationId)).then((result) => result.operation, (error) => settledAs(client, operationId, error, "cancelled", runtime));
+}
+/** Abandon a failed or cancelled import: lift its write block, keeping what it wrote. */
+async function abandonImport(client, operationId, runtime) {
+	return withRetry(runtime, "Abandoning the import", () => client.transferImportAbandon(operationId)).then((result) => result.operation, (error) => settledAs(client, operationId, error, "abandoned", runtime));
+}
+
+//#endregion
+//#region src/cli/commands/site.ts
+/**
+* emdash site
+*
+* Export a whole site to a portable `.emdash` package, and import one into an
+* empty site.
+*/
+/** Exit status when analysis produced a plan with blockers. */
+const EXIT_PLAN_BLOCKED = 2;
+const IMPORT_ACTIONS = new Set([
+	"status",
+	"resume",
+	"receipt",
+	"cancel",
+	"abandon"
+]);
+/** Import states `import status` reports with exit status 1. */
+const UNSUCCESSFUL_STATES = new Set([
+	"failed",
+	"cancelled",
+	"abandoned",
+	"expired"
+]);
+function wantsJson(args) {
+	return Boolean(args.json) || !process.stdout.isTTY;
+}
+function runtimeFor() {
+	const progress = consola$1.create({
+		stdout: process.stderr,
+		stderr: process.stderr
+	});
+	return { reporter: {
+		info: (message) => progress.info(message),
+		warn: (message) => progress.warn(message)
+	} };
+}
+async function confirmOnTerminal(question) {
+	const prompt = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	try {
+		const answer = (await prompt.question(`${question} [y/N] `)).trim().toLowerCase();
+		return answer === "y" || answer === "yes";
+	} finally {
+		prompt.close();
+	}
+}
+/**
+* Ask before a cancel or abandon unless `--yes` or JSON output was chosen.
+* Without a terminal to ask on, the command needs `--yes`.
+*/
+async function confirmed(args, action, operationId, question) {
+	if (args.yes || wantsJson(args)) return true;
+	if (!process.stdin.isTTY) throw new SiteTransferCliError("INVALID_ARGUMENT", `Pass --yes to ${action} import ${operationId} without a confirmation prompt`);
+	return confirmOnTerminal(question);
+}
+function fail(error, args) {
+	const info = describeError(error);
+	if (wantsJson(args)) output({ error: info }, args);
+	else consola$1.error(info.message);
+	process.exitCode = 1;
+}
+/** Every value of a repeatable string flag, from the raw arguments. */
+function collectFlag(rawArgs, name) {
+	const values = [];
+	for (let i = 0; i < rawArgs.length; i++) {
+		const arg = rawArgs[i];
+		if (arg === `--${name}`) {
+			const next = rawArgs[i + 1];
+			if (next !== void 0 && !next.startsWith("--")) {
+				values.push(next);
+				i++;
+			} else throw new SiteTransferCliError("INVALID_ARGUMENT", `--${name} needs a value`);
+		} else if (arg.startsWith(`--${name}=`)) values.push(arg.slice(name.length + 3));
+	}
+	return values;
+}
+function planJson(outcome) {
+	return {
+		operationId: outcome.operation.id,
+		state: outcome.operation.state,
+		packageDigest: outcome.packageDigest,
+		planDigest: outcome.planDigest,
+		executable: outcome.plan.blockers.length === 0,
+		plan: outcome.plan
+	};
+}
+function operationJson(operation) {
+	return {
+		operationId: operation.id,
+		state: operation.state,
+		operation
+	};
+}
+function printPlan(outcome, archivePath) {
+	const { plan } = outcome;
+	consola$1.log(`Import ${outcome.operation.id}`);
+	consola$1.log(`  Package digest: ${outcome.packageDigest}`);
+	consola$1.log(`  Plan digest:    ${outcome.planDigest}`);
+	consola$1.log(`  Origin:         site ${plan.origin.siteId}, exported ${plan.origin.createdAt} by EmDash ${plan.origin.createdByEmDashVersion}`);
+	const counts = Object.entries(plan.counts).map(([kind, count]) => `${kind} ${count}`).join(", ");
+	consola$1.log(`  Records:        ${counts || "none"}`);
+	consola$1.log(`  Size:           records ${formatBytes(plan.bytes.records)}, media ${formatBytes(plan.bytes.media)}`);
+	printSetting("Site title", plan.settings.title, plan.decisions.siteTitle);
+	printSetting("Tagline", plan.settings.tagline, plan.decisions.siteTagline);
+	if (plan.principals.length > 0) {
+		consola$1.log("  Principals (package users; map them with --map-principal <id>=<user|none>):");
+		for (const principal of plan.principals) {
+			const mapped = plan.decisions.principalMappings[principal.id];
+			const target = mapped ? `user ${mapped}` : "unassigned";
+			const suggested = principal.suggestedUserId && principal.suggestedUserId !== mapped ? `, suggested user ${principal.suggestedUserId}` : "";
+			const email = principal.email ? ` <${principal.email}>` : "";
+			consola$1.log(`    ${principal.id}  ${principal.displayName}${email}, ${principal.references} references -> ${target}${suggested}`);
+		}
+	}
+	printTransformations(plan.transformations);
+	printIssues("Warnings", plan.warnings);
+	printIssues("Blockers", plan.blockers);
+	if (plan.blockers.length > 0) {
+		consola$1.error(`The plan has ${plan.blockers.length} blocker(s); it cannot be executed.`);
+		return;
+	}
+	const file = archivePath ?? "<file>";
+	consola$1.success(`Ready. To import, run:\n  emdash site import ${file} --plan ${outcome.planDigest} --confirm`);
+}
+function printSetting(label, values, choice) {
+	const value = choice === "package" ? values.package : values.target;
+	consola$1.log(`  ${`${label}:`.padEnd(16)}${JSON.stringify(value ?? "")} (from the ${choice}; package ${JSON.stringify(values.package ?? "")}, this site ${JSON.stringify(values.target ?? "")})`);
+}
+/** Every declared difference from the source site, one line per code. */
+function printTransformations(transformations) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const transformation of transformations) {
+		const group = groups.get(transformation.code) ?? {
+			count: 0,
+			kinds: /* @__PURE__ */ new Set(),
+			details: []
+		};
+		if ("count" in transformation) group.count += transformation.count;
+		else if ("ids" in transformation) group.count += transformation.ids.length;
+		else group.count += transformation.locales.length;
+		if ("kind" in transformation) group.kinds.add(transformation.kind);
+		if ("locales" in transformation) for (const { from, to } of transformation.locales) group.details.push(`${from} -> ${to}`);
+		if ("items" in transformation) {
+			const types = /* @__PURE__ */ new Map();
+			for (const item of transformation.items) types.set(item.type, (types.get(item.type) ?? 0) + 1);
+			group.details.push(Array.from(types, ([type, count]) => `${type} ${count}`).join(", "));
+		}
+		groups.set(transformation.code, group);
+	}
+	if (groups.size === 0) return;
+	consola$1.log(`  Differences from the source site (${groups.size}):`);
+	for (const [code, group] of groups) {
+		const kinds = group.kinds.size > 0 ? ` [${[...group.kinds].join(", ")}]` : "";
+		consola$1.log(`    ${code}${kinds} x${group.count}: ${transformationLabel(code)}`);
+		for (const detail of group.details) consola$1.log(`      ${detail}`);
+	}
+}
+function printIssues(label, issues) {
+	if (issues.length === 0) return;
+	consola$1.log(`  ${label} (${issues.length}):`);
+	for (const issue of issues) {
+		const where = issue.kind ? ` [${issue.kind}]` : "";
+		const count = issue.count !== void 0 ? ` x${issue.count}` : "";
+		consola$1.log(`    ${issue.code}${where}${count}: ${issue.message}`);
+	}
+}
+function printReceipt(result) {
+	const { receipt } = result;
+	consola$1.success(`Import ${result.operationId} is complete and verified.`);
+	consola$1.log(`  Receipt digest: ${receipt.receiptDigest}${result.receiptDigestValid ? "" : " (INVALID)"}`);
+	consola$1.log(`  Package digest: ${receipt.packageDigest}`);
+	consola$1.log(`  Plan digest:    ${receipt.planDigest}`);
+	consola$1.log(`  Logical digest: ${receipt.logicalDigest}`);
+	consola$1.log(`  Completed:      ${receipt.completedAt}`);
+	const counts = Object.entries(receipt.counts).map(([kind, count]) => `${kind} ${count}`).join(", ");
+	consola$1.log(`  Counts:         ${counts || "none"}`);
+	for (const warning of receipt.warnings) consola$1.warn(`${warning.code}: ${warning.message}`);
+}
+function printOperation(operation, files) {
+	consola$1.log(`Import ${operation.id}: ${operation.state}${operation.stage ? ` (${operation.stage})` : ""}`);
+	const progress = formatProgress(operation.progress);
+	if (progress) consola$1.log(`  Progress:       ${progress}`);
+	if (files) consola$1.log(`  Files:          ${files.verified} uploaded, ${files.declared} still missing`);
+	if (operation.packageDigest) consola$1.log(`  Package digest: ${operation.packageDigest}`);
+	if (operation.planDigest) consola$1.log(`  Plan digest:    ${operation.planDigest}`);
+	if (operation.errorCode) consola$1.warn(`  Error:          ${operation.errorCode}${operation.errorDetail ? ` ${JSON.stringify(operation.errorDetail)}` : ""}`);
+	if (blocksWritesUntilAbandoned(operation)) consola$1.info(`It wrote to this site before it stopped, so site writes stay blocked until you abandon it: emdash site import abandon ${operation.id}`);
+}
+function blocksWritesUntilAbandoned(operation) {
+	return operation.mutationStartedAt !== null && (operation.state === "failed" || operation.state === "cancelled");
+}
+function printCancelled(operation) {
+	if (operation.state !== "cancelled") {
+		consola$1.success(`Cancellation requested. Import ${operation.id} stops after its current batch; check it with: emdash site import status ${operation.id}`);
+		return;
+	}
+	consola$1.success(`Import ${operation.id} is cancelled.`);
+	if (blocksWritesUntilAbandoned(operation)) consola$1.info(`It had started writing to this site. The data it wrote stays, and site writes stay blocked until you abandon it: emdash site import abandon ${operation.id}`);
+	else consola$1.info("It had not written anything to this site.");
+}
+function printAbandoned(operation) {
+	consola$1.success(`Import ${operation.id} is abandoned. The site accepts writes again.`);
+	if (operation.mutationStartedAt !== null) consola$1.info("Data the import already wrote was not removed. Reset this site or set up a new one before importing again.");
+}
+/** Print whatever an import command ended with and set the exit status. */
+function report(outcome, args, archivePath) {
+	if ("receipt" in outcome) {
+		if (wantsJson(args)) output(outcome, args);
+		else printReceipt(outcome);
+		if (!outcome.receiptDigestValid) process.exitCode = 1;
+		return;
+	}
+	if ("plan" in outcome) {
+		if (wantsJson(args)) output(planJson(outcome), args);
+		else printPlan(outcome, archivePath);
+		if (outcome.plan.blockers.length > 0) process.exitCode = EXIT_PLAN_BLOCKED;
+		return;
+	}
+	if (wantsJson(args)) output(operationJson(outcome.operation), args);
+	else {
+		printOperation(outcome.operation);
+		if (isExecuting(outcome.operation)) consola$1.info(`Continue it with: emdash site import resume ${outcome.operation.id}`);
+	}
+	if (!isExecuting(outcome.operation)) process.exitCode = 1;
+}
+const exportCommand = defineCommand({
+	meta: {
+		name: "export",
+		description: "Export the whole site to a .emdash package file"
+	},
+	args: {
+		...connectionArgs,
+		output: {
+			type: "string",
+			alias: "o",
+			description: "Package file to write (e.g. site.emdash)",
+			required: true
+		},
+		comments: {
+			type: "boolean",
+			default: true,
+			description: "Include comments and reactions (--no-comments leaves them out)"
+		}
+	},
+	async run({ args }) {
+		configureOutputMode(args);
+		try {
+			const result = await runSiteExport({
+				client: createClientFromArgs(args),
+				baseUrl: resolveBaseUrl(args),
+				outputPath: resolve(args.output),
+				comments: args.comments !== false
+			}, runtimeFor());
+			if (wantsJson(args)) output(result, args);
+			else {
+				consola$1.success(`Exported ${result.files} files (${formatBytes(result.bytes)}) to ${result.output}`);
+				consola$1.log(`  Package digest: ${result.packageDigest}`);
+			}
+		} catch (error) {
+			fail(error, args);
+		}
+	}
+});
+const importCommand = defineCommand({
+	meta: {
+		name: "import",
+		description: [
+			"Import a .emdash package into an empty site: `import <file> --analyze`, then `import <file> --plan <digest> --confirm`.",
+			"Manage an import with `import status|resume|receipt|cancel|abandon <operation-id>`. `cancel` stops the import after its current batch. `abandon` lifts the write block that a failed or cancelled import leaves on the site; it does not delete what the import wrote.",
+			"Exit codes: 0 success, and for `status` an import in progress or complete; 1 an error, a declined prompt, or for `status` an import that failed, was cancelled or abandoned, or expired; 2 the import plan has blockers."
+		].join("\n\n")
+	},
+	args: {
+		target: {
+			type: "positional",
+			description: "Package file, or status | resume | receipt | cancel | abandon",
+			required: true
+		},
+		...connectionArgs,
+		analyze: {
+			type: "boolean",
+			description: "Upload and analyze the package, then print the import plan"
+		},
+		"map-principal": {
+			type: "string",
+			description: "With --analyze: map a package user to a site user, <principal id|email>=<user id|email|none> (repeatable)"
+		},
+		"use-target-title": {
+			type: "boolean",
+			description: "With --analyze: keep this site's title instead of the package's"
+		},
+		"use-target-tagline": {
+			type: "boolean",
+			description: "With --analyze: keep this site's tagline instead of the package's"
+		},
+		plan: {
+			type: "string",
+			description: "Plan digest printed by --analyze; required with --confirm"
+		},
+		confirm: {
+			type: "boolean",
+			description: "Execute the import plan given by --plan"
+		},
+		yes: {
+			type: "boolean",
+			alias: "y",
+			description: "With cancel or abandon: skip the confirmation prompt"
+		}
+	},
+	async run({ args, rawArgs }) {
+		configureOutputMode(args);
+		try {
+			const positionals = args._.map(String);
+			const action = IMPORT_ACTIONS.has(args.target) ? args.target : null;
+			const client = createClientFromArgs(args);
+			const runtime = runtimeFor();
+			if (action) {
+				const operationId = positionals[1];
+				if (!operationId) throw new SiteTransferCliError("INVALID_ARGUMENT", `Usage: emdash site import ${action} <operation-id>`);
+				if (action === "status") {
+					const status = await importStatus(client, operationId, runtime);
+					if (wantsJson(args)) output(status, args);
+					else printOperation(status.operation, status.files);
+					if (UNSUCCESSFUL_STATES.has(status.operation.state)) process.exitCode = 1;
+					return;
+				}
+				if (action === "cancel" || action === "abandon") {
+					if (!await confirmed(args, action, operationId, action === "cancel" ? `Cancel import ${operationId}? A running import stops after its current batch. Anything it already wrote stays on the site.` : `Abandon import ${operationId}? Site writes are unblocked, but data the import already wrote is not deleted.`)) {
+						consola$1.info("Nothing was changed.");
+						process.exitCode = 1;
+						return;
+					}
+					const operation = action === "cancel" ? await cancelImport(client, operationId, runtime) : await abandonImport(client, operationId, runtime);
+					if (wantsJson(args)) output(operationJson(operation), args);
+					else if (action === "cancel") printCancelled(operation);
+					else printAbandoned(operation);
+					return;
+				}
+				if (action === "receipt") {
+					report(await importReceipt(client, operationId, runtime), args, null);
+					return;
+				}
+				const archive = positionals[2] ? resolve(positionals[2]) : null;
+				report(await resumeImport(client, operationId, archive, runtime), args, archive);
+				return;
+			}
+			const archivePath = resolve(args.target);
+			const mapPrincipal = collectFlag(rawArgs, "map-principal");
+			const flags = {
+				mapPrincipal,
+				useTargetTitle: Boolean(args["use-target-title"]),
+				useTargetTagline: Boolean(args["use-target-tagline"])
+			};
+			if (args.confirm && !args.plan) throw new SiteTransferCliError("INVALID_ARGUMENT", "--confirm needs --plan <digest>: review the plan with --analyze first");
+			if (args.plan && !args.confirm) throw new SiteTransferCliError("INVALID_ARGUMENT", "--plan executes an import only together with --confirm");
+			if (args.plan && args.analyze) throw new SiteTransferCliError("INVALID_ARGUMENT", "Use either --analyze or --plan <digest> --confirm, not both");
+			if (args.plan) {
+				if (mapPrincipal.length > 0 || flags.useTargetTitle || flags.useTargetTagline) throw new SiteTransferCliError("INVALID_ARGUMENT", "Decisions can only be changed with --analyze; they change the plan digest");
+				report(await confirmPackage(client, archivePath, normalizePlanDigest(args.plan), runtime), args, archivePath);
+				return;
+			}
+			if (!args.analyze) throw new SiteTransferCliError("INVALID_ARGUMENT", "Choose --analyze to review the import plan, or --plan <digest> --confirm to run it");
+			report(await analyzePackage(client, archivePath, flags, runtime), args, archivePath);
+		} catch (error) {
+			fail(error, args);
+		}
+	}
+});
+const siteCommand = defineCommand({
+	meta: {
+		name: "site",
+		description: "Export or import a whole site as a .emdash package"
+	},
+	subCommands: {
+		export: exportCommand,
+		import: importCommand
+	}
+});
+
 //#endregion
 //#region src/cli/commands/taxonomy.ts
 /**
@@ -5470,7 +6884,8 @@ runMain(defineCommand({
 		search: searchCommand,
 		taxonomy: taxonomyCommand,
 		menu: menuCommand,
-		plugin: pluginCommand
+		plugin: pluginCommand,
+		site: siteCommand
 	}
 }));