@evomap/evolver-core 2.0.0-beta.0 → 2.0.0-beta.10

package/dist/assetstore/index.d.ts

@@ -1,8 +1,12 @@
 export * from './provider.js';
 export * from './localJsonl.js';
+export * from './assetStoreHealth.js';
+export * from './assetSidecarRecovery.js';
 export * from './remoteStub.js';
 export * from './learningHistory.js';
 export * from './provenance.js';
+export * from './assetSyncLedger.js';
 export * from './reviewLedger.js';
 export * from './reviewFilter.js';
-export * from './pendingSignals.js';
+export * from './pendingSignals.js';
+export * from './seedGenes.js';

package/dist/assetstore/index.js

@@ -1,8 +1,12 @@
 export * from './provider.js';
 export * from './localJsonl.js';
+export * from './assetStoreHealth.js';
+export * from './assetSidecarRecovery.js';
 export * from './remoteStub.js';
 export * from './learningHistory.js';
 export * from './provenance.js';
+export * from './assetSyncLedger.js';
 export * from './reviewLedger.js';
 export * from './reviewFilter.js';
-export * from './pendingSignals.js';
+export * from './pendingSignals.js';
+export * from './seedGenes.js';

package/dist/assetstore/localJsonl.d.ts

@@ -1,23 +1,32 @@
-import { type AssetKind, type AssetRecord, type AssetStoreProvider, type PutResult, type SearchQuery } from './provider.js';
+import { type AssetKind, type AssetRecord, type AssetStoreProvider, type ConditionalPutOptions, type ConditionalPutResult, type PutResult, type SearchQuery } from './provider.js';
 /**
  * 本地 jsonl 资产库(M3-2, 移植 v1 src/gep/assetStore.js 单写锁).
  * 每 kind 一文件(genes/capsules/events.jsonl); append-only; O_EXCL 文件锁防并发写撕裂;
- * 内存索引(asset_id→record)供 get/search; 同 asset_id 去重(内容寻址天然幂等).
+ * 内存索引(asset_id→record)供 get/search; 文件指纹变化时在共享锁内重建索引，保证多个
+ * CLI/daemon 进程之间可见; 写入也在锁内刷新后再按 asset_id 去重(内容寻址天然幂等).
  */
 export declare class LocalJsonlProvider implements AssetStoreProvider {
     readonly baseDir: string;
     private readonly index;
     private readonly lockPath;
+    private fileState;
     private loaded;
     constructor(baseDir: string);
-    private ensureLoaded;
+    private captureFileState;
+    private stateChanged;
+    private rebuildIndex;
+    private refreshUnderLock;
+    private ensureFresh;
+    private updateFileStateAfterWrite;
     put(asset: AssetRecord): Promise<PutResult>;
+    putConditional(asset: AssetRecord, options?: ConditionalPutOptions): Promise<ConditionalPutResult>;
     /**
      * 迁移专用(M8-2): 以**冻结 asset_id** 原样写入, 不经 normalizeForPut 重算/校验.
      * 仅 v1→v2 导入用(硬化 A6 存量冻结); 普通写一律走 put(). record 必须自带 asset_id.
      */
     putFrozen(record: AssetRecord): Promise<PutResult>;
     get(assetId: string): Promise<AssetRecord | null>;
+    findByLogicalId(id: string, limit?: number): Promise<AssetRecord[]>;
     list(kind?: AssetKind, limit?: number): Promise<AssetRecord[]>;
     search(q: SearchQuery): Promise<AssetRecord[]>;
     /**

package/dist/assetstore/localJsonl.js

@@ -1,8 +1,8 @@
-import { appendFileSync, existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { acquireLock, releaseLock } from '../util/fileLock.js';
+import { appendUtf8Durable, assertAssetStoreDirectory, assertOptionalRegularFile, ensureAssetStoreDirectory, readUtf8Regular, regularFileFingerprint, replaceUtf8Durable, } from './assetStoreStorage.js';
+import { LOCAL_ASSET_FILES } from './assetStoreLayout.js';
 import { normalizeForPut, } from './provider.js';
-const FILES = { Gene: 'genes.jsonl', Capsule: 'capsules.jsonl', EvolutionEvent: 'events.jsonl', AntiGene: 'anti-genes.jsonl' };
 function signalsOf(a) {
     const out = [];
     for (const key of ['signals_match', 'signals', 'trigger', 'trigger_signals']) {
@@ -17,79 +17,157 @@ function signalsOf(a) {
 /**
  * 本地 jsonl 资产库(M3-2, 移植 v1 src/gep/assetStore.js 单写锁).
  * 每 kind 一文件(genes/capsules/events.jsonl); append-only; O_EXCL 文件锁防并发写撕裂;
- * 内存索引(asset_id→record)供 get/search; 同 asset_id 去重(内容寻址天然幂等).
+ * 内存索引(asset_id→record)供 get/search; 文件指纹变化时在共享锁内重建索引，保证多个
+ * CLI/daemon 进程之间可见; 写入也在锁内刷新后再按 asset_id 去重(内容寻址天然幂等).
  */
 export class LocalJsonlProvider {
     baseDir;
     index = new Map();
     lockPath;
+    fileState = new Map();
     loaded = false;
     // `baseDir` is public-readonly so callers that inject a store (e.g. the CLI under test) can co-locate sidecars
     // — the ReviewLedger/ProvenanceStore — in the SAME directory, instead of defaulting to the real ~/.evomap.
     constructor(baseDir) {
         this.baseDir = baseDir;
-        mkdirSync(baseDir, { recursive: true });
+        ensureAssetStoreDirectory(baseDir);
         this.lockPath = join(baseDir, '.assetstore.lock');
     }
-    ensureLoaded() {
-        if (this.loaded)
-            return;
-        for (const file of Object.values(FILES)) {
+    captureFileState() {
+        assertAssetStoreDirectory(this.baseDir);
+        const state = new Map();
+        for (const [kind, file] of Object.entries(LOCAL_ASSET_FILES)) {
+            state.set(kind, regularFileFingerprint(join(this.baseDir, file)));
+        }
+        return state;
+    }
+    stateChanged(next) {
+        if (!this.loaded || next.size !== this.fileState.size)
+            return true;
+        for (const [kind, fingerprint] of next) {
+            if (this.fileState.get(kind) !== fingerprint)
+                return true;
+        }
+        return false;
+    }
+    rebuildIndex(state) {
+        const next = new Map();
+        for (const file of Object.values(LOCAL_ASSET_FILES)) {
             const p = join(this.baseDir, file);
-            if (!existsSync(p))
+            const raw = readUtf8Regular(p);
+            if (raw === null)
                 continue;
-            for (const line of readFileSync(p, 'utf8').split('\n')) {
+            for (const line of raw.split('\n')) {
                 if (!line.trim())
                     continue;
                 try {
                     const r = JSON.parse(line);
                     if (r.asset_id)
-                        this.index.set(r.asset_id, r);
+                        next.set(r.asset_id, r);
                 }
                 catch { /* skip 坏行 */ }
             }
         }
+        this.index.clear();
+        for (const [assetId, record] of next)
+            this.index.set(assetId, record);
+        this.fileState = state;
+        this.loaded = true;
+    }
+    refreshUnderLock() {
+        const state = this.captureFileState();
+        if (this.stateChanged(state))
+            this.rebuildIndex(state);
+    }
+    ensureFresh() {
+        const state = this.captureFileState();
+        if (!this.stateChanged(state))
+            return;
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
+        acquireLock(this.lockPath);
+        try {
+            this.refreshUnderLock();
+        }
+        finally {
+            releaseLock(this.lockPath);
+        }
+    }
+    updateFileStateAfterWrite() {
+        this.fileState = this.captureFileState();
         this.loaded = true;
     }
     async put(asset) {
-        this.ensureLoaded();
+        return this.putConditional(asset, { allowLogicalCollision: true });
+    }
+    async putConditional(asset, options) {
         const { record, verified } = normalizeForPut(asset);
-        if (this.index.has(record.asset_id))
-            return { asset_id: record.asset_id, stored: false, verified };
-        const file = join(this.baseDir, FILES[record.type]);
+        const file = join(this.baseDir, LOCAL_ASSET_FILES[record.type]);
+        const logicalId = typeof record.id === 'string' ? record.id : undefined;
+        let collision;
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
-            // 锁内复检(另一进程可能刚写)
-            if (!this.index.has(record.asset_id)) {
-                appendFileSync(file, `${JSON.stringify(record)}\n`);
-                this.index.set(record.asset_id, record);
+            // Refresh under the shared lock so another process cannot append between reload and dedupe.
+            this.refreshUnderLock();
+            if (this.index.has(record.asset_id)) {
+                return {
+                    asset_id: record.asset_id,
+                    stored: false,
+                    verified,
+                    status: 'already_exists',
+                    logicalId,
+                };
             }
-            else {
-                return { asset_id: record.asset_id, stored: false, verified };
+            collision = logicalId === undefined
+                ? undefined
+                : [...this.index.values()].find((existing) => (existing.type === record.type
+                    && existing.id === logicalId
+                    && existing.asset_id !== record.asset_id));
+            if (collision && !options?.allowLogicalCollision) {
+                return {
+                    asset_id: record.asset_id,
+                    stored: false,
+                    verified,
+                    status: 'logical_collision',
+                    logicalId,
+                    collisionWithAssetId: collision.asset_id,
+                };
             }
+            appendUtf8Durable(file, `${JSON.stringify(record)}\n`);
+            this.index.set(record.asset_id, record);
+            this.updateFileStateAfterWrite();
         }
         finally {
             releaseLock(this.lockPath);
         }
-        return { asset_id: record.asset_id, stored: true, verified };
+        return {
+            asset_id: record.asset_id,
+            stored: true,
+            verified,
+            status: 'stored',
+            ...(collision ? {
+                logicalId,
+                collisionWithAssetId: collision.asset_id,
+            } : {}),
+        };
     }
     /**
      * 迁移专用(M8-2): 以**冻结 asset_id** 原样写入, 不经 normalizeForPut 重算/校验.
      * 仅 v1→v2 导入用(硬化 A6 存量冻结); 普通写一律走 put(). record 必须自带 asset_id.
      */
     async putFrozen(record) {
-        this.ensureLoaded();
         if (!record.asset_id)
             throw new Error('putFrozen 需 record 自带冻结 asset_id');
-        if (this.index.has(record.asset_id))
-            return { asset_id: record.asset_id, stored: false, verified: false };
-        const file = join(this.baseDir, FILES[record.type]);
+        const file = join(this.baseDir, LOCAL_ASSET_FILES[record.type]);
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
+            this.refreshUnderLock();
             if (this.index.has(record.asset_id))
                 return { asset_id: record.asset_id, stored: false, verified: false };
-            appendFileSync(file, `${JSON.stringify(record)}\n`);
+            appendUtf8Durable(file, `${JSON.stringify(record)}\n`);
             this.index.set(record.asset_id, record);
+            this.updateFileStateAfterWrite();
         }
         finally {
             releaseLock(this.lockPath);
@@ -97,11 +175,24 @@ export class LocalJsonlProvider {
         return { asset_id: record.asset_id, stored: true, verified: false };
     }
     async get(assetId) {
-        this.ensureLoaded();
+        this.ensureFresh();
         return this.index.get(assetId) ?? null;
     }
+    async findByLogicalId(id, limit = 2) {
+        this.ensureFresh();
+        const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(1_000, Math.floor(limit))) : 2;
+        const out = [];
+        for (const record of this.index.values()) {
+            if (record['id'] !== id)
+                continue;
+            out.push(record);
+            if (out.length >= boundedLimit)
+                break;
+        }
+        return out;
+    }
     async list(kind, limit = 1000) {
-        this.ensureLoaded();
+        this.ensureFresh();
         const out = [];
         for (const r of this.index.values()) {
             if (!kind || r.type === kind)
@@ -112,7 +203,7 @@ export class LocalJsonlProvider {
         return out;
     }
     async search(q) {
-        this.ensureLoaded();
+        this.ensureFresh();
         const out = [];
         for (const r of this.index.values()) {
             if (q.kind && r.type !== q.kind)
@@ -125,8 +216,8 @@ export class LocalJsonlProvider {
             if (q.gene && r.gene !== q.gene)
                 continue;
             if (q.signalsAny && q.signalsAny.length > 0) {
-                const sig = new Set(signalsOf(r));
-                if (!q.signalsAny.some((s) => sig.has(s)))
+                const sig = new Set(signalsOf(r).map((signal) => signal.trim().toLowerCase()));
+                if (!q.signalsAny.some((signal) => sig.has(signal.trim().toLowerCase())))
                     continue;
             }
             if (q.text) {
@@ -148,15 +239,17 @@ export class LocalJsonlProvider {
      * the write lock. Returns kept/removed line counts.
      */
     async compact() {
-        this.ensureLoaded();
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
+            this.refreshUnderLock();
             let kept = 0, removed = 0;
-            for (const [kind, file] of Object.entries(FILES)) {
+            for (const [kind, file] of Object.entries(LOCAL_ASSET_FILES)) {
                 const p = join(this.baseDir, file);
-                if (!existsSync(p))
+                const raw = readUtf8Regular(p);
+                if (raw === null)
                     continue;
-                const lines = readFileSync(p, 'utf8').split('\n').filter((l) => l.trim());
+                const lines = raw.split('\n').filter((l) => l.trim());
                 const byId = new Map(); // asset_id → raw line (last wins, matching load semantics)
                 for (const line of lines) {
                     try {
@@ -167,12 +260,11 @@ export class LocalJsonlProvider {
                     catch { /* drop corrupt line */ }
                 }
                 const out = byId.size ? `${[...byId.values()].join('\n')}\n` : '';
-                const tmp = `${p}.compact.tmp`;
-                writeFileSync(tmp, out);
-                renameSync(tmp, p); // atomic replace; a crash mid-compact leaves the original intact
+                replaceUtf8Durable(p, out);
                 kept += byId.size;
                 removed += lines.length - byId.size;
             }
+            this.rebuildIndex(this.captureFileState());
             return { kept, removed };
         }
         finally {

package/dist/assetstore/pendingSignals.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { acquireLock, releaseLock } from '../util/fileLock.js';
 import { LocalJsonlProvider } from './localJsonl.js';
 const MAX_SIGNAL_LENGTH = 200;
@@ -33,6 +33,8 @@ function findRepoRoot(start) {
     while (current) {
         if (existsSync(join(current, '.git')))
             return current;
+        if (basename(current) === 'node_modules')
+            return null;
         const parent = dirname(current);
         if (parent === current)
             return null;

package/dist/assetstore/provenance.d.ts

@@ -1,13 +1,21 @@
-import { type AssetStoreProvider, type AssetRecord, type PutResult } from './provider.js';
+import { type AssetStoreProvider, type AssetRecord, type ConditionalPutOptions, type ConditionalPutResult, type PutResult } from './provider.js';
 export type ProvenanceSource = 'local' | 'migrated' | 'hub';
+export type ProvenanceDecision = 'promoted' | 'revoked';
 export interface ProvenanceRecord {
     assetId: string;
     source: ProvenanceSource;
     trusted: boolean;
     at: string;
+    decision?: ProvenanceDecision;
+    decidedBy?: string;
+    /** Legacy promotion actor field kept for existing sidecar readers. */
     promotedBy?: string;
     reason?: string;
 }
+export interface ProvenanceTrustChange {
+    changed: boolean;
+    record: ProvenanceRecord;
+}
 /**
  * Append-only JSONL sidecar (last-write-wins) at <baseDir>/provenance.jsonl. Default for an asset with NO
  * record = trusted: the only local writers (cycleEngine self-produce, v1 migration) are trusted and never
@@ -16,10 +24,14 @@ export interface ProvenanceRecord {
 export declare class ProvenanceStore {
     private readonly now;
     private readonly path;
+    private readonly lockPath;
     private readonly index;
-    private loaded;
+    private fileState;
     constructor(baseDir: string, now?: () => number);
-    private load;
+    private rebuildIndex;
+    private refreshUnderLock;
+    private withFreshRead;
+    private appendUnderLock;
     /** Record provenance for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec: Omit<ProvenanceRecord, 'at'> & {
         at?: string;
@@ -28,12 +40,23 @@ export declare class ProvenanceStore {
     get(assetId: string): ProvenanceRecord | null;
     /** No record → trusted (local default); a record → its trusted flag. */
     isTrusted(assetId: string): boolean;
+    /** One linearizable trust snapshot for bounded batch readers. */
+    snapshot(): ReadonlyMap<string, ProvenanceRecord>;
+    /** Compare and append one trust decision under the same cross-process lock. */
+    changeTrust(assetId: string, trusted: boolean, by: string, reason: string): ProvenanceTrustChange;
     /** Explicit, audited untrusted→trusted promotion. Appends a new trusted record carrying who/why. */
     promote(assetId: string, by: string, reason: string): ProvenanceRecord;
+    /** Explicit, audited trusted-to-untrusted revocation. A record-less asset is local by default. */
+    revoke(assetId: string, by: string, reason: string): ProvenanceRecord;
 }
 /**
  * The sanctioned hub→local-pool landing: store the asset (store.put recomputes/normalizes the asset_id, so a
  * remote-supplied asset_id is never trusted) and mark it untrusted in the sidecar. This is the ONLY path that
  * should bring hub-fetched assets into the local pool — trust-first from the first byte (#30.1).
  */
-export declare function ingestUntrusted(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, source?: ProvenanceSource): Promise<PutResult>;
+export declare function ingestUntrusted(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, source?: ProvenanceSource): Promise<PutResult>;
+/**
+ * Conditional variant used by Hub sync to reject a logical-id collision without ever allowing a Hub record
+ * to become implicitly trusted. Providers that cannot make the condition atomically are rejected here.
+ */
+export declare function ingestUntrustedConditional(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, options?: ConditionalPutOptions, source?: ProvenanceSource): Promise<ConditionalPutResult>;

package/dist/assetstore/provenance.js

@@ -3,9 +3,13 @@
 // by asset_id, NOT a field on the asset: asset_id = sha256(canonicalize(asset)), and "how we got it" metadata
 // must not enter the content hash (#30.2), or it would break content-addressing. Trust-first by construction:
 // selection defaults to trusted-only; an untrusted asset is promoted to trusted only by an explicit, logged act.
-import { appendFileSync, closeSync, existsSync, openSync, readFileSync, readSync, mkdirSync, statSync, truncateSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { normalizeForPut } from './provider.js';
+import { normalizeForPut, supportsAtomicConditionalPut, validateConditionalPutResult, } from './provider.js';
+import { appendUtf8Durable, assertAssetStoreDirectory, ensureAssetStoreDirectory, readUtf8Regular, regularFileFingerprint, truncateUtf8SuffixDurable, withAssetStoreLock, } from './assetStoreStorage.js';
+import { assertTrustSidecarHealthy, parseProvenanceRecord, parseSidecarJsonl, } from './assetSidecarRecords.js';
+function immutableRecord(record) {
+    return Object.freeze({ ...record });
+}
 /**
  * Append-only JSONL sidecar (last-write-wins) at <baseDir>/provenance.jsonl. Default for an asset with NO
  * record = trusted: the only local writers (cycleEngine self-produce, v1 migration) are trusted and never
@@ -14,81 +18,113 @@ import { normalizeForPut } from './provider.js';
 export class ProvenanceStore {
     now;
     path;
+    lockPath;
     index = new Map();
-    loaded = false;
+    fileState = null;
     constructor(baseDir, now = Date.now) {
         this.now = now;
+        ensureAssetStoreDirectory(baseDir);
         this.path = join(baseDir, 'provenance.jsonl');
+        this.lockPath = join(baseDir, '.assetstore.lock');
     }
-    load() {
-        if (this.loaded)
-            return;
-        if (existsSync(this.path)) {
-            for (const line of readFileSync(this.path, 'utf8').split('\n')) {
-                if (!line.trim())
-                    continue;
-                try {
-                    const r = JSON.parse(line);
-                    if (r.assetId)
-                        this.index.set(r.assetId, r);
-                }
-                catch { /* skip corrupt line */ }
-            }
+    rebuildIndex(state) {
+        const next = new Map();
+        const raw = state === 'missing' ? null : readUtf8Regular(this.path);
+        if (raw !== null) {
+            const parsed = parseSidecarJsonl(raw, parseProvenanceRecord);
+            assertTrustSidecarHealthy('provenance', parsed);
+            for (const record of parsed.records)
+                next.set(record.assetId, immutableRecord(record));
         }
-        this.loaded = true;
+        this.index.clear();
+        for (const [assetId, record] of next)
+            this.index.set(assetId, record);
+        this.fileState = state;
+    }
+    refreshUnderLock() {
+        const state = regularFileFingerprint(this.path);
+        if (state !== this.fileState)
+            this.rebuildIndex(state);
+    }
+    withFreshRead(read) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return read(this.index);
+        });
+    }
+    appendUnderLock(full) {
+        const stored = immutableRecord(full);
+        appendUtf8Durable(this.path, `${JSON.stringify(stored)}\n`);
+        this.index.set(stored.assetId, stored);
+        this.fileState = regularFileFingerprint(this.path);
+        return stored;
     }
     /** Record provenance for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec) {
-        this.load();
         const full = { ...rec, at: rec.at ?? new Date(this.now()).toISOString() };
-        mkdirSync(dirname(this.path), { recursive: true });
-        appendFileSync(this.path, `${JSON.stringify(full)}\n`);
-        this.index.set(full.assetId, full);
-        return full;
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return this.appendUnderLock(full);
+        });
     }
     rollbackLast(rec) {
         const line = `${JSON.stringify(rec)}\n`;
-        const lineBytes = Buffer.byteLength(line, 'utf8');
         try {
-            if (!existsSync(this.path))
-                return;
-            const stat = statSync(this.path);
-            if (!stat.isFile() || stat.size < lineBytes)
-                return;
-            const offset = stat.size - lineBytes;
-            const buf = Buffer.alloc(lineBytes);
-            const fd = openSync(this.path, 'r');
-            try {
-                readSync(fd, buf, 0, lineBytes, offset);
-            }
-            finally {
-                closeSync(fd);
-            }
-            if (buf.toString('utf8') !== line)
-                return;
-            truncateSync(this.path, offset);
-            this.index.clear();
-            this.loaded = false;
+            assertAssetStoreDirectory(dirname(this.path));
+            withAssetStoreLock(this.lockPath, () => {
+                if (!truncateUtf8SuffixDurable(this.path, line)) {
+                    this.refreshUnderLock();
+                    return;
+                }
+                this.rebuildIndex(regularFileFingerprint(this.path));
+            });
         }
         catch {
             this.index.clear();
-            this.loaded = false;
+            this.fileState = null;
         }
     }
     get(assetId) {
-        this.load();
-        return this.index.get(assetId) ?? null;
+        return this.withFreshRead((index) => index.get(assetId) ?? null);
     }
     /** No record → trusted (local default); a record → its trusted flag. */
     isTrusted(assetId) {
-        this.load();
-        const r = this.index.get(assetId);
-        return r ? r.trusted : true;
+        return this.withFreshRead((index) => index.get(assetId)?.trusted ?? true);
+    }
+    /** One linearizable trust snapshot for bounded batch readers. */
+    snapshot() {
+        return this.withFreshRead((index) => new Map(index));
+    }
+    /** Compare and append one trust decision under the same cross-process lock. */
+    changeTrust(assetId, trusted, by, reason) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            const current = this.index.get(assetId) ?? null;
+            if (current?.trusted === trusted)
+                return { changed: false, record: current };
+            const full = {
+                assetId,
+                source: current?.source ?? 'local',
+                trusted,
+                at: new Date(this.now()).toISOString(),
+                decision: trusted ? 'promoted' : 'revoked',
+                decidedBy: by,
+                ...(trusted ? { promotedBy: by } : {}),
+                reason,
+            };
+            return { changed: true, record: this.appendUnderLock(full) };
+        });
     }
     /** Explicit, audited untrusted→trusted promotion. Appends a new trusted record carrying who/why. */
     promote(assetId, by, reason) {
-        const cur = this.get(assetId);
-        return this.mark({ assetId, source: cur?.source ?? 'hub', trusted: true, promotedBy: by, reason });
+        return this.changeTrust(assetId, true, by, reason).record;
+    }
+    /** Explicit, audited trusted-to-untrusted revocation. A record-less asset is local by default. */
+    revoke(assetId, by, reason) {
+        return this.changeTrust(assetId, false, by, reason).record;
     }
 }
 /**
@@ -99,11 +135,26 @@ export class ProvenanceStore {
 export async function ingestUntrusted(store, prov, record, source = 'hub') {
     const normalized = normalizeForPut(record);
     const mark = prov.mark({ assetId: normalized.record.asset_id, source, trusted: false });
-    try {
-        return await store.put(record);
-    }
-    catch (err) {
+    const result = await store.put(record);
+    // A thrown write has an ambiguous outcome: the asset may have reached disk before the acknowledgement was
+    // lost. Keep the untrusted marker in that case so a persisted Hub asset can never fall through the default
+    // no-record => trusted policy. Only an explicit no-write result is safe to roll back.
+    if (!result.stored)
         prov.rollbackLast(mark);
-        throw err;
+    return result;
+}
+/**
+ * Conditional variant used by Hub sync to reject a logical-id collision without ever allowing a Hub record
+ * to become implicitly trusted. Providers that cannot make the condition atomically are rejected here.
+ */
+export async function ingestUntrustedConditional(store, prov, record, options, source = 'hub') {
+    if (!supportsAtomicConditionalPut(store)) {
+        throw new Error('asset store does not support conditional writes');
     }
+    const normalized = normalizeForPut(record);
+    const mark = prov.mark({ assetId: normalized.record.asset_id, source, trusted: false });
+    const result = validateConditionalPutResult(await store.putConditional(record, options), normalized.record.asset_id, options);
+    if (!result.stored)
+        prov.rollbackLast(mark);
+    return result;
 }