@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/assetstore/localJsonl.js

@@ -1,23 +1,20 @@
-import { appendFileSync, existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs';
+import { unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { acquireLock, releaseLock } from '../util/fileLock.js';
-import { normalizeForPut, } from './provider.js';
-const FILES = { Gene: 'genes.jsonl', Capsule: 'capsules.jsonl', EvolutionEvent: 'events.jsonl', AntiGene: 'anti-genes.jsonl' };
-function isErrno(error, code) {
-    return typeof error === 'object' && error !== null && error.code === code;
+import { appendUtf8Durable, assertAssetStoreDirectory, assertOptionalRegularFile, ensureAssetStoreDirectory, fsyncDirectoryBestEffort, readUtf8Regular, regularFileFingerprint, replaceUtf8Durable, } from './assetStoreStorage.js';
+import { LOCAL_ASSET_FILES } from './assetStoreLayout.js';
+import { FrozenAssetIdCollisionError, frozenAssetRecordsEqual, normalizeForPut, } from './provider.js';
+function resultLogicalId(logicalId) {
+    return logicalId !== undefined && logicalId.length > 0 && logicalId === logicalId.trim()
+        ? logicalId
+        : undefined;
 }
-function fileFingerprint(path) {
-    try {
-        const stat = statSync(path, { bigint: true });
-        return `${stat.dev}:${stat.ino}:${stat.mode}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
-    }
-    catch (error) {
-        if (isErrno(error, 'ENOENT'))
-            return 'missing';
-        throw error;
-    }
-}
-function signalsOf(a) {
+const BUNDLE_JOURNAL_FILE = '.assetstore-bundle.json';
+const BUNDLE_JOURNAL_SCHEMA = 'evolver.assetstore-bundle.v1';
+const MAX_BUNDLE_ASSETS = 64;
+const MAX_BUNDLE_JOURNAL_BYTES = 4 * 1024 * 1024;
+/** Signal names a record advertises, across the four key spellings the pool uses. */
+export function signalsOf(a) {
     const out = [];
     for (const key of ['signals_match', 'signals', 'trigger', 'trigger_signals']) {
         const v = a[key];
@@ -38,19 +35,22 @@ export class LocalJsonlProvider {
     baseDir;
     index = new Map();
     lockPath;
+    bundleJournalPath;
     fileState = new Map();
     loaded = false;
     // `baseDir` is public-readonly so callers that inject a store (e.g. the CLI under test) can co-locate sidecars
     // — the ReviewLedger/ProvenanceStore — in the SAME directory, instead of defaulting to the real ~/.evomap.
     constructor(baseDir) {
         this.baseDir = baseDir;
-        mkdirSync(baseDir, { recursive: true });
+        ensureAssetStoreDirectory(baseDir);
         this.lockPath = join(baseDir, '.assetstore.lock');
+        this.bundleJournalPath = join(baseDir, BUNDLE_JOURNAL_FILE);
     }
     captureFileState() {
+        assertAssetStoreDirectory(this.baseDir);
         const state = new Map();
-        for (const [kind, file] of Object.entries(FILES)) {
-            state.set(kind, fileFingerprint(join(this.baseDir, file)));
+        for (const [kind, file] of Object.entries(LOCAL_ASSET_FILES)) {
+            state.set(kind, regularFileFingerprint(join(this.baseDir, file)));
         }
         return state;
     }
@@ -65,11 +65,12 @@ export class LocalJsonlProvider {
     }
     rebuildIndex(state) {
         const next = new Map();
-        for (const file of Object.values(FILES)) {
+        for (const file of Object.values(LOCAL_ASSET_FILES)) {
             const p = join(this.baseDir, file);
-            if (!existsSync(p))
+            const raw = readUtf8Regular(p);
+            if (raw === null)
                 continue;
-            for (const line of readFileSync(p, 'utf8').split('\n')) {
+            for (const line of raw.split('\n')) {
                 if (!line.trim())
                     continue;
                 try {
@@ -93,10 +94,12 @@ export class LocalJsonlProvider {
     }
     ensureFresh() {
         const state = this.captureFileState();
-        if (!this.stateChanged(state))
+        if (!this.hasPendingBundle() && !this.stateChanged(state))
             return;
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
+            this.recoverPendingBundleUnderLock();
             this.refreshUnderLock();
         }
         finally {
@@ -107,50 +110,252 @@ export class LocalJsonlProvider {
         this.fileState = this.captureFileState();
         this.loaded = true;
     }
+    readPendingBundle() {
+        if (assertOptionalRegularFile(this.bundleJournalPath, 'temp_file') === null)
+            return undefined;
+        const raw = readUtf8Regular(this.bundleJournalPath, MAX_BUNDLE_JOURNAL_BYTES);
+        if (raw === null)
+            return undefined;
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error('asset store bundle journal is malformed');
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('asset store bundle journal is malformed');
+        }
+        const journal = parsed;
+        const assets = journal['assets'];
+        if (journal['schema'] !== BUNDLE_JOURNAL_SCHEMA || !Array.isArray(assets) || assets.length === 0 || assets.length > MAX_BUNDLE_ASSETS) {
+            throw new Error('asset store bundle journal is invalid');
+        }
+        return assets.map((asset) => {
+            if (!asset || typeof asset !== 'object' || Array.isArray(asset))
+                throw new Error('asset store bundle journal is invalid');
+            const record = asset;
+            if (typeof record.type !== 'string' || !Object.prototype.hasOwnProperty.call(LOCAL_ASSET_FILES, record.type)
+                || typeof record.asset_id !== 'string' || record.asset_id.length === 0) {
+                throw new Error('asset store bundle journal is invalid');
+            }
+            return record;
+        });
+    }
+    recoverPendingBundleUnderLock() {
+        const pending = this.readPendingBundle();
+        if (!pending)
+            return;
+        this.refreshUnderLock();
+        for (const pendingRecord of pending) {
+            const { record } = normalizeForPut(pendingRecord);
+            if (record.asset_id !== pendingRecord.asset_id)
+                throw new Error('asset store bundle journal asset_id mismatch');
+            const existing = this.index.get(record.asset_id);
+            if (existing) {
+                if (!frozenAssetRecordsEqual(existing, record))
+                    throw new FrozenAssetIdCollisionError(record.asset_id);
+                continue;
+            }
+            appendUtf8Durable(join(this.baseDir, LOCAL_ASSET_FILES[record.type]), `${JSON.stringify(record)}\n`);
+            this.index.set(record.asset_id, record);
+        }
+        unlinkSync(this.bundleJournalPath);
+        fsyncDirectoryBestEffort(this.baseDir);
+        this.updateFileStateAfterWrite();
+    }
+    hasPendingBundle() {
+        return assertOptionalRegularFile(this.bundleJournalPath, 'temp_file') !== null;
+    }
     async put(asset) {
+        return this.putConditional(asset, { allowLogicalCollision: true });
+    }
+    async putConditional(asset, options) {
         const { record, verified } = normalizeForPut(asset);
-        const file = join(this.baseDir, FILES[record.type]);
+        const file = join(this.baseDir, LOCAL_ASSET_FILES[record.type]);
+        const logicalId = typeof record.id === 'string' ? record.id : undefined;
+        let collision;
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
+            this.recoverPendingBundleUnderLock();
             // Refresh under the shared lock so another process cannot append between reload and dedupe.
             this.refreshUnderLock();
-            if (this.index.has(record.asset_id))
-                return { asset_id: record.asset_id, stored: false, verified };
-            appendFileSync(file, `${JSON.stringify(record)}\n`);
+            const existing = this.index.get(record.asset_id);
+            if (existing) {
+                if (!frozenAssetRecordsEqual(existing, record))
+                    throw new FrozenAssetIdCollisionError(record.asset_id);
+                return {
+                    asset_id: record.asset_id,
+                    stored: false,
+                    verified,
+                    status: 'already_exists',
+                    ...(resultLogicalId(logicalId) ? { logicalId } : {}),
+                };
+            }
+            collision = logicalId === undefined
+                ? undefined
+                : [...this.index.values()].find((existing) => (existing.type === record.type
+                    && existing.id === logicalId
+                    && existing.asset_id !== record.asset_id));
+            if (collision && !options?.allowLogicalCollision) {
+                return {
+                    asset_id: record.asset_id,
+                    stored: false,
+                    verified,
+                    status: 'logical_collision',
+                    ...(resultLogicalId(logicalId) ? { logicalId } : {}),
+                    collisionWithAssetId: collision.asset_id,
+                };
+            }
+            appendUtf8Durable(file, `${JSON.stringify(record)}\n`);
             this.index.set(record.asset_id, record);
             this.updateFileStateAfterWrite();
         }
         finally {
             releaseLock(this.lockPath);
         }
-        return { asset_id: record.asset_id, stored: true, verified };
+        return {
+            asset_id: record.asset_id,
+            stored: true,
+            verified,
+            status: 'stored',
+            ...(collision ? {
+                ...(resultLogicalId(logicalId) ? { logicalId } : {}),
+                collisionWithAssetId: collision.asset_id,
+            } : {}),
+        };
+    }
+    async putBundle(assets) {
+        if (assets.length === 0)
+            return [];
+        if (assets.length > MAX_BUNDLE_ASSETS)
+            throw new Error('asset store bundle is too large');
+        const normalized = assets.map((asset) => normalizeForPut(asset));
+        const seen = new Map();
+        for (const normalizedRecord of normalized) {
+            const { record } = normalizedRecord;
+            const previous = seen.get(record.asset_id);
+            if (previous && !frozenAssetRecordsEqual(previous.record, record))
+                throw new FrozenAssetIdCollisionError(record.asset_id);
+            if (!previous)
+                seen.set(record.asset_id, normalizedRecord);
+        }
+        const results = [];
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
+        acquireLock(this.lockPath);
+        try {
+            this.recoverPendingBundleUnderLock();
+            this.refreshUnderLock();
+            const pending = [];
+            for (const { record, verified } of seen.values()) {
+                const existing = this.index.get(record.asset_id);
+                if (existing) {
+                    if (!frozenAssetRecordsEqual(existing, record))
+                        throw new FrozenAssetIdCollisionError(record.asset_id);
+                    results.push({ asset_id: record.asset_id, stored: false, verified });
+                    continue;
+                }
+                pending.push(record);
+                results.push({ asset_id: record.asset_id, stored: true, verified });
+            }
+            if (pending.length === 0)
+                return results;
+            const journal = `${JSON.stringify({ schema: BUNDLE_JOURNAL_SCHEMA, assets: pending })}\n`;
+            if (Buffer.byteLength(journal, 'utf8') > MAX_BUNDLE_JOURNAL_BYTES) {
+                throw new Error('asset store bundle is too large');
+            }
+            replaceUtf8Durable(this.bundleJournalPath, journal);
+            for (const record of pending) {
+                appendUtf8Durable(join(this.baseDir, LOCAL_ASSET_FILES[record.type]), `${JSON.stringify(record)}\n`);
+                this.index.set(record.asset_id, record);
+            }
+            unlinkSync(this.bundleJournalPath);
+            fsyncDirectoryBestEffort(this.baseDir);
+            this.updateFileStateAfterWrite();
+        }
+        finally {
+            releaseLock(this.lockPath);
+        }
+        return results;
     }
     /**
      * 迁移专用(M8-2): 以**冻结 asset_id** 原样写入, 不经 normalizeForPut 重算/校验.
      * 仅 v1→v2 导入用(硬化 A6 存量冻结); 普通写一律走 put(). record 必须自带 asset_id.
      */
     async putFrozen(record) {
+        return this.putFrozenConditional(record, { allowLogicalCollision: true });
+    }
+    async putFrozenConditional(record, options = {}) {
         if (!record.asset_id)
             throw new Error('putFrozen 需 record 自带冻结 asset_id');
-        const file = join(this.baseDir, FILES[record.type]);
+        const file = join(this.baseDir, LOCAL_ASSET_FILES[record.type]);
+        let logicalId;
+        let collision;
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
+            this.recoverPendingBundleUnderLock();
             this.refreshUnderLock();
-            if (this.index.has(record.asset_id))
-                return { asset_id: record.asset_id, stored: false, verified: false };
-            appendFileSync(file, `${JSON.stringify(record)}\n`);
+            const existing = this.index.get(record.asset_id);
+            if (existing) {
+                if (!frozenAssetRecordsEqual(existing, record))
+                    throw new FrozenAssetIdCollisionError(record.asset_id);
+                return { asset_id: record.asset_id, stored: false, verified: false, status: 'already_exists' };
+            }
+            logicalId = typeof record['id'] === 'string' && record['id'].length > 0
+                ? record['id']
+                : undefined;
+            collision = logicalId === undefined
+                ? undefined
+                : [...this.index.values()].find((candidate) => (candidate.type === record.type
+                    && candidate['id'] === logicalId
+                    && candidate.asset_id !== record.asset_id));
+            if (collision && !options.allowLogicalCollision) {
+                return {
+                    asset_id: record.asset_id,
+                    stored: false,
+                    verified: false,
+                    status: 'logical_collision',
+                    ...(resultLogicalId(logicalId) ? { logicalId } : {}),
+                    collisionWithAssetId: collision.asset_id,
+                };
+            }
+            appendUtf8Durable(file, `${JSON.stringify(record)}\n`);
             this.index.set(record.asset_id, record);
             this.updateFileStateAfterWrite();
         }
         finally {
             releaseLock(this.lockPath);
         }
-        return { asset_id: record.asset_id, stored: true, verified: false };
+        return {
+            asset_id: record.asset_id,
+            stored: true,
+            verified: false,
+            status: 'stored',
+            ...(collision ? {
+                ...(resultLogicalId(logicalId) ? { logicalId } : {}),
+                collisionWithAssetId: collision.asset_id,
+            } : {}),
+        };
     }
     async get(assetId) {
         this.ensureFresh();
         return this.index.get(assetId) ?? null;
     }
+    async findByLogicalId(id, limit = 2, kind) {
+        this.ensureFresh();
+        const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(1_000, Math.floor(limit))) : 2;
+        const out = [];
+        for (const record of this.index.values()) {
+            if (record['id'] !== id || (kind !== undefined && record.type !== kind))
+                continue;
+            out.push(record);
+            if (out.length >= boundedLimit)
+                break;
+        }
+        return out;
+    }
     async list(kind, limit = 1000) {
         this.ensureFresh();
         const out = [];
@@ -162,6 +367,10 @@ export class LocalJsonlProvider {
         }
         return out;
     }
+    listAll(kind) {
+        this.ensureFresh();
+        return [...this.index.values()].filter((record) => kind === undefined || record.type === kind);
+    }
     async search(q) {
         this.ensureFresh();
         const out = [];
@@ -176,8 +385,8 @@ export class LocalJsonlProvider {
             if (q.gene && r.gene !== q.gene)
                 continue;
             if (q.signalsAny && q.signalsAny.length > 0) {
-                const sig = new Set(signalsOf(r));
-                if (!q.signalsAny.some((s) => sig.has(s)))
+                const sig = new Set(signalsOf(r).map((signal) => signal.trim().toLowerCase()));
+                if (!q.signalsAny.some((signal) => sig.has(signal.trim().toLowerCase())))
                     continue;
             }
             if (q.text) {
@@ -199,15 +408,17 @@ export class LocalJsonlProvider {
      * the write lock. Returns kept/removed line counts.
      */
     async compact() {
+        assertOptionalRegularFile(this.lockPath, 'lock_file');
         acquireLock(this.lockPath);
         try {
             this.refreshUnderLock();
             let kept = 0, removed = 0;
-            for (const [kind, file] of Object.entries(FILES)) {
+            for (const [kind, file] of Object.entries(LOCAL_ASSET_FILES)) {
                 const p = join(this.baseDir, file);
-                if (!existsSync(p))
+                const raw = readUtf8Regular(p);
+                if (raw === null)
                     continue;
-                const lines = readFileSync(p, 'utf8').split('\n').filter((l) => l.trim());
+                const lines = raw.split('\n').filter((l) => l.trim());
                 const byId = new Map(); // asset_id → raw line (last wins, matching load semantics)
                 for (const line of lines) {
                     try {
@@ -218,9 +429,7 @@ export class LocalJsonlProvider {
                     catch { /* drop corrupt line */ }
                 }
                 const out = byId.size ? `${[...byId.values()].join('\n')}\n` : '';
-                const tmp = `${p}.compact.tmp`;
-                writeFileSync(tmp, out);
-                renameSync(tmp, p); // atomic replace; a crash mid-compact leaves the original intact
+                replaceUtf8Durable(p, out);
                 kept += byId.size;
                 removed += lines.length - byId.size;
             }

package/dist/assetstore/provenance.d.ts

@@ -1,17 +1,67 @@
-import { type AssetStoreProvider, type AssetRecord, type PutResult } from './provider.js';
+import { type AssetStoreProvider, type AssetRecord, type ConditionalPutOptions, type ConditionalPutResult, type PutResult } from './provider.js';
 export type ProvenanceSource = 'local' | 'migrated' | 'hub';
+export type ProvenanceDecision = 'promoted' | 'revoked';
+export declare const UNVERIFIED_V1_IMPORT_REASON = "unverified_v1_import";
 export interface ProvenanceRecord {
     assetId: string;
     source: ProvenanceSource;
     trusted: boolean;
     at: string;
+    decision?: ProvenanceDecision;
+    decidedBy?: string;
+    /** Legacy promotion actor field kept for existing sidecar readers. */
     promotedBy?: string;
     reason?: string;
+    /** Canonical content id of the exact hash-mismatched body accepted by a supported unverified ingest. */
+    frozenContentId?: string;
+}
+export interface ProvenanceTrustChange {
+    changed: boolean;
+    record: ProvenanceRecord;
+}
+export type UnverifiedIngestDisposition = {
+    readonly status: 'create';
+    readonly assetId: string;
+    readonly frozenContentId: string;
+    readonly provenanceAction: 'stage_and_finalize';
+} | {
+    readonly status: 'already_bound';
+    readonly assetId: string;
+    readonly frozenContentId: string;
+    readonly provenanceAction: 'finalize' | 'none';
+} | {
+    readonly status: 'preserve_trust';
+    readonly assetId: string;
+    readonly frozenContentId: string;
+    readonly provenanceAction: 'none';
+} | {
+    readonly status: 'collision';
+    readonly assetId: string;
+    readonly frozenContentId: string;
+    readonly collision: 'asset' | 'provenance';
+    readonly provenanceAction: 'none';
+};
+/**
+ * Resolve the exact no-I/O disposition used by {@link ingestUnverified}. Callers may inspect a read-only
+ * target snapshot during migration planning, then apply through ingestUnverified without duplicating its
+ * trust and collision rules.
+ */
+export declare function planUnverifiedIngest(record: AssetRecord, existing: AssetRecord | null, currentProvenance: ProvenanceRecord | null, reason: string, source?: ProvenanceSource): UnverifiedIngestDisposition;
+/**
+ * A frozen hash mismatch is benign only while its latest provenance record is an undecided, content-bound
+ * waiver created by a supported ingest path. Keep the storage/health classification centralized; downstream
+ * reuse and sync apply their own stricter allowlists before an unverified asset may leave quarantine.
+ */
+export declare function isActiveUnverifiedProvenance(record: ProvenanceRecord | null | undefined, frozenContentId: string | null | undefined): boolean;
+export declare class ProvenanceWritePendingError extends Error {
+    readonly assetId: string;
+    readonly code = "PROVENANCE_WRITE_PENDING";
+    constructor(assetId: string);
 }
 /**
  * Append-only JSONL sidecar (last-write-wins) at <baseDir>/provenance.jsonl. Default for an asset with NO
- * record = trusted: the only local writers (cycleEngine self-produce, v1 migration) are trusted and never
- * write here; the sole untrusted source — hub ingestion — ALWAYS marks via {@link ingestUntrusted}/mark.
+ * record = trusted: verified local writers (cycleEngine self-produce and self-consistent v1 migration rows)
+ * do not write here. Every untrusted or hash-mismatched ingest path MUST mark before persistence.
  */
 export declare class ProvenanceStore {
     private readonly now;
@@ -23,22 +73,61 @@ export declare class ProvenanceStore {
     private rebuildIndex;
     private refreshUnderLock;
     private withFreshRead;
+    private appendUnderLock;
     /** Record provenance for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec: Omit<ProvenanceRecord, 'at'> & {
         at?: string;
     }): ProvenanceRecord;
+    /** Stage a verified Hub write without replacing an in-flight conservative marker. */
+    stageUntrustedWriteTracked(assetId: string, source: ProvenanceSource): {
+        record: ProvenanceRecord;
+        appended: boolean;
+    };
+    /** Finalize a verified write unless an operator made an explicit decision during I/O. */
+    finalizeUntrustedWrite(assetId: string, source: ProvenanceSource): ProvenanceRecord;
+    /** Stage an unverified write without overwriting an explicit trust decision or another conservative marker. */
+    stageUnverifiedWrite(assetId: string, source: ProvenanceSource, frozenContentId: string): ProvenanceRecord;
+    stageUnverifiedWriteTracked(assetId: string, source: ProvenanceSource, frozenContentId: string): {
+        record: ProvenanceRecord;
+        appended: boolean;
+    };
+    /** Atomically replace only a pending/no decision with the health-waiver reason after verified persistence. */
+    finalizeUnverifiedWrite(assetId: string, source: ProvenanceSource, reason: string, frozenContentId: string): ProvenanceRecord;
     rollbackLast(rec: ProvenanceRecord): void;
     get(assetId: string): ProvenanceRecord | null;
     /** No record → trusted (local default); a record → its trusted flag. */
     isTrusted(assetId: string): boolean;
     /** One linearizable trust snapshot for bounded batch readers. */
     snapshot(): ReadonlyMap<string, ProvenanceRecord>;
+    /** Compare and append one trust decision under the same cross-process lock. */
+    changeTrust(assetId: string, trusted: boolean, by: string, reason: string): ProvenanceTrustChange;
     /** Explicit, audited untrusted→trusted promotion. Appends a new trusted record carrying who/why. */
     promote(assetId: string, by: string, reason: string): ProvenanceRecord;
+    /** Explicit, audited trusted-to-untrusted revocation. A record-less asset is local by default. */
+    revoke(assetId: string, by: string, reason: string): ProvenanceRecord;
 }
 /**
  * The sanctioned hub→local-pool landing: store the asset (store.put recomputes/normalizes the asset_id, so a
  * remote-supplied asset_id is never trusted) and mark it untrusted in the sidecar. This is the ONLY path that
  * should bring hub-fetched assets into the local pool — trust-first from the first byte (#30.1).
  */
-export declare function ingestUntrusted(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, source?: ProvenanceSource): Promise<PutResult>;
+export declare function ingestUntrusted(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, source?: ProvenanceSource): Promise<PutResult>;
+/**
+ * Hub → local-pool landing for an asset whose content does NOT hash to its declared asset_id. The hub
+ * demonstrably rewrites delivered payloads (injected `validation`, wholesale `payload_backfill_reason`
+ * synthesis — evolver-v2#570), which breaks {@link ingestUntrusted}'s normalizeForPut self-consistency check
+ * even though the loop's own in-run reuse already consumes hub content without re-verifying it (adapter
+ * `hubReuse.ts`). Rather than hard-reject a save the operator explicitly asked for, freeze the asset under its
+ * declared (network) asset_id via `putFrozen` and mark it untrusted in the sidecar with an explicit reason.
+ * Trust-first still holds (#30.1): selection defaults to trusted-only, so an unverified asset never silently
+ * enters the reasoning pool — it lands where the operator put it and stays flagged until an explicit,
+ * audited promotion. `reason` records WHY verification was waived (e.g. hub rewrite vs synthesized payload).
+ */
+export declare function ingestUnverified(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, reason: string, source?: ProvenanceSource): Promise<PutResult>;
+/** Atomic frozen variant used by reuse so the logical-id check and append share one provider lock. */
+export declare function ingestUnverifiedConditional(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, reason: string, options?: ConditionalPutOptions, source?: ProvenanceSource): Promise<ConditionalPutResult>;
+/**
+ * Conditional variant used by Hub sync to reject a logical-id collision without ever allowing a Hub record
+ * to become implicitly trusted. Providers that cannot make the condition atomically are rejected here.
+ */
+export declare function ingestUntrustedConditional(store: AssetStoreProvider, prov: ProvenanceStore, record: AssetRecord, options?: ConditionalPutOptions, source?: ProvenanceSource): Promise<ConditionalPutResult>;