@gregiteen/ssss-cli 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to the SSSS (Structured Semantic Syntax System) spec will be
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.1] - 2026-07-08
+### Fixed
+- Reduced `resource_bound` primitives to requirement declarations in `template`
+  and `sale` exports, preventing seller-bound domain, phone, or integration
+  values from leaking into bundles.
+- Rejected malformed bundles with missing `files` arrays and unknown
+  `required_extensions`.
+- Preserved nested frontmatter maps and arrays during patch serialization.
+- Corrected `ssss import --dry-run` accounting to report `would commit` counts
+  while leaving target vaults empty.
+- Generated starter and reference task files now use the valid `pending` task
+  status.
+
+### Added
+- Conformance coverage for resource-bound export reduction, strict bundle
+  validation, lease conflict/expiry/unreadable-state behavior, nested
+  frontmatter patching, `ssss new` scaffold validation, and dry-run import
+  behavior.
+- `docs/help/leases.md` and completed `IMPROVEMENTS` project documentation.
+- Full package content for the `push` skill so skill conformance passes.
+
 ## [0.7.0] - 2026-07-02
 ### Changed
 - **BREAKING: universal frontmatter enforcement** — every SSSS document primitive

package/README.md

@@ -22,15 +22,15 @@ SSSS is the vendor-neutral standard and reference implementation shared by
 - **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a
   vault, then `export → provision → import` it into a fresh tenant, deterministically.
 
-This package, `@ssss/cli`, is **dependency-free**: a host needs neither Zod nor a YAML
+This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML
 library to be conformant. The reference engine *is* the validator.
 
 ## Install
 
 ```bash
-npm install -g @ssss/cli      # the `ssss` command
+npm install -g @gregiteen/ssss-cli      # the `ssss` command
 # or use it as a library:
-npm install @ssss/cli
+npm install @gregiteen/ssss-cli
 ```
 
 Requires Node 18+. No runtime dependencies.
@@ -79,16 +79,16 @@ ssss import festival.ucw.json --vault ./new-tenant \
 | `ssss import <bundle>` | Replay a bundle/plan into a vault via the engine (idempotent). |
 | `ssss autolink [dir]` | Generate OKF wiki-links across a vault. |
 | `ssss conformance` | Run the canonical conformance suite (§12). |
-| `ssss help [topic]` | Local docs: `runtime`, `portability`, `bundle`, `provisioning`, … |
+| `ssss help [topic]` | Local docs: `runtime`, `portability`, `bundle`, `provisioning`, `leases`, … |
 
 Run `ssss <command> --help` for flags, or `ssss help <topic>` for concepts.
 
 ## Use as a library
 
 ```js
-import { createEngine } from '@ssss/cli/engine';
-import { exportBundle, validateBundle, provisionBundle, importBundle } from '@ssss/cli/bundle';
-import { planWorkflowTrigger } from '@ssss/cli/runtime';
+import { createEngine } from '@gregiteen/ssss-cli/engine';
+import { exportBundle, validateBundle, provisionBundle, importBundle } from '@gregiteen/ssss-cli/bundle';
+import { planWorkflowTrigger } from '@gregiteen/ssss-cli/runtime';
 
 const bundle = exportBundle('./my-vault', { profile: 'sale', name: 'Festival in a Box' });
 const { valid, errors } = validateBundle(bundle);
@@ -115,9 +115,9 @@ const runtimePlan = planWorkflowTrigger({
 });
 ```
 
-Exports: `@ssss/cli` / `@ssss/cli/engine` (Operation Contract engine),
-`@ssss/cli/bundle` (export/provision/import), `@ssss/cli/registry`,
-`@ssss/cli/runtime`, `@ssss/cli/frontmatter`.
+Exports: `@gregiteen/ssss-cli` / `@gregiteen/ssss-cli/engine` (Operation Contract engine),
+`@gregiteen/ssss-cli/bundle` (export/provision/import), `@gregiteen/ssss-cli/registry`,
+`@gregiteen/ssss-cli/runtime`, `@gregiteen/ssss-cli/frontmatter`.
 
 ## Portability — why a vault is safe to sell
 

package/VERSION

@@ -1 +1 @@
-0.7.0
+0.7.1

package/conformance/README.md

@@ -31,12 +31,14 @@ npx ssss conformance --endpoint <url> --token <pat>   # run fixtures against a l
 
 The runner validates that the fixture file is well-formed and that every
 `expected_response` is internally consistent with the envelope rules. With
-`--engine`, it replays every fixture through the reference engine (`src/engine.mjs`)
-checks workflow runtime planning (`src/runtime.mjs`, spec §11.8), and round-trips
-the reference bundle (validate → provision → import → re-import, spec §16/§17)
-against a temp vault — proving idempotency and that no `tenant_private` file ever
-lands. With `--endpoint`, it POSTs each fixture's `request` to a host's Operation
-Contract endpoint and diffs the response.
+`--engine`, it replays every fixture through the reference engine (`src/engine.mjs`),
+checks workflow runtime planning (`src/runtime.mjs`, spec §11.8), runs regression
+coverage for patch serialization and leases (§6/§7), and round-trips the
+reference bundle (validate → provision → import → re-import, spec §16/§17)
+against a temp vault — proving idempotency, strict bundle shape validation, and
+that no `tenant_private` or seller-bound `resource_bound` value ever lands. With
+`--endpoint`, it POSTs each fixture's `request` to a host's Operation Contract
+endpoint and diffs the response.
 
 ## Core vs. extension registry
 

package/conformance/reference-bundle.ucw.json

@@ -39,6 +39,14 @@
         "system": "email",
         "mode": "provision",
         "required": false
+      },
+      {
+        "id": "bind-domain",
+        "label": "Bind domain",
+        "system": "domains",
+        "mode": "provision",
+        "required": true,
+        "notes": "owns_domain"
       }
     ],
     "parameters": [
@@ -66,11 +74,20 @@
         "scope": "workspace",
         "source": "user",
         "required": false
+      },
+      {
+        "key": "domain_registrar",
+        "label": "domain registrar",
+        "type": "string",
+        "scope": "workspace",
+        "source": "user",
+        "required": false,
+        "description": "Satisfies the domain resource requirement field 'registrar'."
       }
     ],
     "file_count": 14,
     "provenance": {
-      "content_hash": "sha256:96380f618ee1e178331beca9507e1b3cd28a3d12cfa7f9898317f98da8295218",
+      "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
       "exporter": "@ssss/cli@0.7.0"
     }
   },
@@ -85,7 +102,7 @@
     },
     {
       "path": "domains/festival.md",
-      "content": "---\ntype: domain\ntitle: Festival Domain Requirement\ndescription: Domain resource requirement that the buyer binds during provisioning.\ntimestamp: 2026-07-02T00:00:00Z\ndomain_name: REQUIREMENT\nregistrar: REQUIREMENT\nstatus: required\npayment_status: unbound\nx_portability: resource_bound\n---\nThis festival needs a domain. The buyer binds their own at provision (owns_domain)."
+      "content": "---\ntype: domain\ntitle: Festival Domain Requirement\ndescription: Domain resource requirement that the buyer binds during provisioning.\ntimestamp: \"2026-07-02T00:00:00Z\"\ndomain_name: REQUIREMENT\nregistrar: REQUIREMENT\nstatus: required\npayment_status: unbound\nx_portability: resource_bound\n---\nThis festival needs a domain. The buyer binds their own at provision (owns_domain)."
     },
     {
       "path": "domains/index.md",

package/docs/help/import.md

@@ -12,8 +12,10 @@ ssss import --plan plan.json   --vault <dir>     # replay a plan from `ssss prov
 - `--vault <dir>` is required and is created if missing.
 - Without `--plan`, import provisions inline first (resolving `--param` flags); a
   failed provision (unresolved params / dangling links) aborts before any write.
-- `--dry-run` validates every envelope without committing.
-- The summary reports `committed`, `unchanged (idempotent)`, and `failed` counts.
+- `--dry-run` validates every envelope without committing and reports
+  `would commit` instead of `committed`.
+- The normal summary reports `committed`, `unchanged (idempotent)`, and `failed`
+  counts.
 
 Run `ssss import --help` for the full flag list.
 See also: `ssss help provisioning`, `ssss provision`.

package/docs/help/leases.md

@@ -0,0 +1,31 @@
+# Leases (spec §7)
+
+Leases are file-level write locks checked by the Operation Contract before a
+write commits. They protect paths that are being edited by another actor or host
+process.
+
+The reference engine expects lease state in a host-provided `leaseStore`:
+
+```text
+<leaseStore>/<workspace_id>/<sha256(path)>.lease.json
+```
+
+Each lease file contains:
+
+```json
+{
+  "lease_id": "lease-123",
+  "expires_at": "2026-07-08T23:00:00.000Z"
+}
+```
+
+Behavior:
+
+- If no lease exists, the write can continue.
+- If a non-expired lease exists, the envelope must provide the matching
+  `lease_id`.
+- A mismatched or missing `lease_id` fails validation before commit.
+- Expired leases are removed and do not block the write.
+- Unreadable lease state fails closed; the engine refuses to guess.
+
+See also: `ssss help roles`, `ssss help conformance`.

package/docs/help/overview.md

@@ -4,7 +4,7 @@ The **Structured Semantic Syntax System** is a database-free, Markdown-first sch
 and mutation contract for AI-agent state. A vault is a directory of Markdown files
 with YAML frontmatter; every file declares a `type` defined in the registry.
 
-`@ssss/cli` is the reference implementation: a dependency-free Operation Contract
+`@gregiteen/ssss-cli` is the reference implementation: a dependency-free Operation Contract
 engine, a registry-driven validator, and the `.ucw` bundle/provisioning tooling.
 
 ## The pieces

package/docs/help/portability.md

@@ -20,8 +20,16 @@ restrictive of (type default, override) wins.
 | `template` | structural + resource_bound | A reusable template, private data stripped. |
 | `sale` | structural + resource_bound | A tradeable business, private data stripped. |
 
-> `template` and `sale` exports MUST drop every `tenant_private` primitive. The
-> reference bundle (`conformance/reference-bundle.ucw.json`) proves this: its
-> `task` ticket is dropped from the `sale` export.
+> `template` and `sale` exports MUST drop every `tenant_private` primitive and
+> reduce every `resource_bound` primitive to a requirement declaration. The
+> seller's actual domain, phone number, provider, or connection value must not
+> appear in the bundle.
+
+For resource-bound files, the reference exporter uses the extension registry's
+`resource.binds` metadata to replace bound fields with `REQUIREMENT` and add
+matching provisioning requirements. The reference bundle
+(`conformance/reference-bundle.ucw.json`) proves both guarantees: its `task`
+ticket is dropped from the `sale` export, and its `domain` file carries only
+requirement placeholders.
 
 See also: `ssss help bundle`, `ssss help export`.

package/docs/help/runtime.md

@@ -54,11 +54,11 @@ database canonical.
 
 ## Reference helpers
 
-Use `@ssss/cli/runtime` when building a host daemon:
+Use `@gregiteen/ssss-cli/runtime` when building a host daemon:
 
 ```js
-import { createEngine } from '@ssss/cli/engine';
-import { planWorkflowTrigger } from '@ssss/cli/runtime';
+import { createEngine } from '@gregiteen/ssss-cli/engine';
+import { planWorkflowTrigger } from '@gregiteen/ssss-cli/runtime';
 
 const plan = planWorkflowTrigger({
   workflowPath: 'workflows/daily-digest/WORKFLOW.md',

package/docs/help/scaffold.md

@@ -13,7 +13,7 @@ ssss new my-app --with-total-recall --install
 
 ```
 my-app/
-  package.json        @ssss/cli pinned to this CLI's version tag; npm test = node --test
+  package.json        @gregiteen/ssss-cli pinned to this CLI's version tag; npm test = node --test
   vault/              Starter SSSS documents:
     rules/welcome.md         (structural)
     workflows/onboarding.md  (structural, links [[welcome]])
@@ -38,7 +38,7 @@ provisions, and re-imports idempotently as a `sale` bundle (§16/§17) — with
 | `--with-total-recall` | Add `total-recall-brain` + memory wiring to CLAUDE.md/README. |
 | `--install` | Run `npm install`, Total Recall `init` (if requested), then `npm test`. |
 | `--no-git` | Skip `git init`. |
-| `--ref <git-ref>` | Pin `@ssss/cli` to a specific tag/branch/SHA (default: this CLI's version tag). |
+| `--ref <git-ref>` | Pin `@gregiteen/ssss-cli` to a specific tag/branch/SHA (default: this CLI's version tag). |
 | `--force` | Scaffold into a non-empty directory. |
 
 Shelling out (git/npm/npx) uses `execFileSync` with fixed argument vectors — no shell,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gregiteen/ssss-cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "CLI tools and the reference engine for the Structured Semantic Syntax System",
   "main": "src/engine.mjs",
   "exports": {

package/scripts/build-reference-bundle.mjs

@@ -104,7 +104,7 @@ description: Private support task for an attendee seat-change request.
 timestamp: 2026-07-02T00:00:00Z
 priority: high
 category: support
-status: open
+status: pending
 ---
 Attendee jane@example.com requested a seat change.`,
 };

package/scripts/cmd-import.mjs

@@ -63,7 +63,11 @@ export async function run(argv) {
   const engine = createEngine({ registryDir: flags.registry });
   const result = importBundle(envelopes, vault, engine);
   const failed = result.results.filter((r) => !r.success);
-  console.log(`${result.ok ? '✓' : '✗'} import — ${result.committed} committed, ${envelopes.length - result.committed} unchanged (idempotent), ${failed.length} failed → ${vault}`);
+  if (flags['dry-run']) {
+    console.log(`${result.ok ? '✓' : '✗'} import dry-run — ${result.wouldCommit || 0} would commit, ${envelopes.length - (result.wouldCommit || 0)} unchanged (idempotent), ${failed.length} failed → ${vault}`);
+  } else {
+    console.log(`${result.ok ? '✓' : '✗'} import — ${result.committed} committed, ${envelopes.length - result.committed} unchanged (idempotent), ${failed.length} failed → ${vault}`);
+  }
   if (failed.length) {
     for (const r of failed) console.error(`  ✗ ${r.path}: ${(r.validation?.errors || []).join('; ')}`);
     process.exit(1);

package/scripts/cmd-new.mjs

@@ -2,7 +2,7 @@
  * `ssss new` — scaffold a fresh repo wired for SSSS (and, optionally, Total Recall).
  *
  * Produces a ready-to-run project: a starter `vault/` of core primitives, the
- * `@ssss/cli` dependency pinned to this CLI's own version tag, a dependency-free
+ * `@gregiteen/ssss-cli` dependency pinned to this CLI's own version tag, a dependency-free
  * conformance test (`node --test`) that replays the canonical fixtures through the
  * engine AND round-trips the vault as a `sale` bundle, plus a CLAUDE.md describing
  * the conventions. With `--with-total-recall` it also wires the Total Recall
@@ -31,7 +31,7 @@ const HELP = usage({
     ['--with-total-recall', 'Also wire the Total Recall memory OS (total-recall-brain).'],
     ['--install', 'Run `npm install` after scaffolding (and Total Recall init if requested).'],
     ['--no-git', 'Do not run `git init`.'],
-    ['--ref <git-ref>', `Pin @ssss/cli to this ref (default: v${VERSION}).`],
+    ['--ref <git-ref>', `Pin @gregiteen/ssss-cli to this ref (default: v${VERSION}).`],
     ['--force', 'Allow scaffolding into a non-empty directory.'],
   ],
   examples: [
@@ -81,7 +81,7 @@ export async function run(argv) {
       export: 'ssss export vault --profile sale --out dist/bundle.ucw.json',
       validate: 'ssss conformance --engine',
     },
-    dependencies: { '@ssss/cli': `github:gregiteen/ssss#${ref}` },
+    dependencies: { '@gregiteen/ssss-cli': `github:gregiteen/ssss#${ref}` },
     ...(withTR ? { devDependencies: { 'total-recall-brain': 'latest' } } : {}),
   };
   W(root, 'package.json', JSON.stringify(pkg, null, 2) + '\n');
@@ -94,7 +94,7 @@ export async function run(argv) {
   W(root, 'vault/assistants/concierge.md',
     '---\ntype: assistant\ntitle: Concierge\ndescription: Starter assistant definition for the project.\ntimestamp: 2026-07-02T00:00:00Z\nname: Concierge\n---\n\n# Concierge\n\nA starter assistant definition.\n');
   W(root, 'vault/tasks/first-task.md',
-    '---\ntype: task\ntitle: First Task\ndescription: Starter private setup task that demonstrates tenant_private filtering.\ntimestamp: 2026-07-02T00:00:00Z\npriority: normal\ncategory: setup\nstatus: open\n---\n\n# First task\n\nThis is `tenant_private` (§5.5) — it is **dropped** from `template`/`sale` exports.\n');
+    '---\ntype: task\ntitle: First Task\ndescription: Starter private setup task that demonstrates tenant_private filtering.\ntimestamp: 2026-07-02T00:00:00Z\npriority: normal\ncategory: setup\nstatus: pending\n---\n\n# First task\n\nThis is `tenant_private` (§5.5) — it is **dropped** from `template`/`sale` exports.\n');
 
   // ── conformance test (zero-dependency: node --test) ─────────────────────
   W(root, 'test/ssss-conformance.test.mjs', CONFORMANCE_TEST);
@@ -107,7 +107,7 @@ export async function run(argv) {
   // ── git + install (best-effort, flag-gated, no shell) ───────────────────
   const log = (m) => console.error(m);
   log(`Scaffolded SSSS project → ${root}`);
-  log(`  @ssss/cli pinned to github:gregiteen/ssss#${ref}`);
+  log(`  @gregiteen/ssss-cli pinned to github:gregiteen/ssss#${ref}`);
   if (withTR) log('  Total Recall wired (total-recall-brain).');
 
   if (!flags['no-git'] && !fs.existsSync(path.join(root, '.git'))) {
@@ -153,11 +153,11 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { createEngine } from '@ssss/cli/engine';
-import { exportBundle, validateBundle, provisionBundle, importBundle } from '@ssss/cli/bundle';
+import { createEngine } from '@gregiteen/ssss-cli/engine';
+import { exportBundle, validateBundle, provisionBundle, importBundle } from '@gregiteen/ssss-cli/bundle';
 
 const require = createRequire(import.meta.url);
-const { fixtures } = require('@ssss/cli/conformance/fixtures.json');
+const { fixtures } = require('@gregiteen/ssss-cli/conformance/fixtures.json');
 const VAULT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'vault');
 
 test('engine implements the canonical Operation Contract (spec §6)', () => {
@@ -199,7 +199,7 @@ function readme(name, withTR) {
   return `# ${name}
 
 An [SSSS](https://github.com/gregiteen/ssss)-native project: a Markdown **vault** is
-the source of truth, validated and packaged by the dependency-free \`@ssss/cli\`.
+the source of truth, validated and packaged by the dependency-free \`@gregiteen/ssss-cli\`.
 
 ## Layout
 
@@ -240,9 +240,9 @@ This repo uses **SSSS** (Structured Semantic Syntax System) as its state contrac
 
 ## Source of truth
 - \`vault/\` is the only source of truth — typed Markdown documents with YAML
-  frontmatter. Every file declares a \`type\` defined in the \`@ssss/cli\` core registry.
+  frontmatter. Every file declares a \`type\` defined in the \`@gregiteen/ssss-cli\` core registry.
 - Mutate the vault through the standard, not by hand-writing files in bulk:
-  \`npx ssss\` for bundle/tenant tooling, or the \`@ssss/cli/engine\` Operation Contract
+  \`npx ssss\` for bundle/tenant tooling, or the \`@gregiteen/ssss-cli/engine\` Operation Contract
   in code.
 
 ## Portability (§5.5) — the rule that matters

package/scripts/conformance.mjs

@@ -14,6 +14,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { createEngine } from '../src/engine.mjs';
 import { validateBundle, provisionBundle, importBundle } from '../src/bundle.mjs';
@@ -194,6 +196,26 @@ function runBundleConformance() {
   check('reference bundle is schema- and hash-valid', valid, errors.join('; '));
   check('sale profile carries no tenant_private file',
     bundle.files.every((f) => parseDocument(f.content).data.type !== 'task' && parseDocument(f.content).data.type !== 'conversation'));
+  check('sale profile reduces resource_bound fields to requirement declarations',
+    bundle.files.every((f) => {
+      const data = parseDocument(f.content).data;
+      if (data.type !== 'domain') return true;
+      return data.domain_name === 'REQUIREMENT' && data.registrar === 'REQUIREMENT';
+    }));
+
+  const missingFilesBundle = JSON.parse(JSON.stringify(bundle));
+  delete missingFilesBundle.files;
+  const missingFilesValidation = validateBundle(missingFilesBundle, { registryDir: REGISTRY_DIR });
+  check('bundle validation rejects missing files array',
+    !missingFilesValidation.valid && missingFilesValidation.errors.some((e) => e.includes('bundle.files must be an array')),
+    missingFilesValidation.errors.join('; '));
+
+  const unknownExtensionBundle = JSON.parse(JSON.stringify(bundle));
+  unknownExtensionBundle.manifest.required_extensions = ['missing-extension'];
+  const unknownExtensionValidation = validateBundle(unknownExtensionBundle, { registryDir: REGISTRY_DIR });
+  check('bundle validation rejects unknown required_extensions entries',
+    !unknownExtensionValidation.valid && unknownExtensionValidation.errors.some((e) => e.includes("required extension 'missing-extension'")),
+    unknownExtensionValidation.errors.join('; '));
 
   const prov = provisionBundle(bundle, { workspaceId: 'ws-conf', parameters: { business_name: 'Demo', domain: 'demo.example' } });
   check('provision resolves params + link integrity (no dangling [[links]])', prov.ok,
@@ -225,6 +247,180 @@ function runBundleConformance() {
   return pass === checks.length;
 }
 
+function runOperationContractRegressionConformance() {
+  const checks = [];
+  const check = (name, cond, detail = '') => { checks.push({ name, cond, detail }); };
+
+  const vault = fs.mkdtempSync(path.join(os.tmpdir(), 'ssss-op-reg-'));
+  const leaseStore = fs.mkdtempSync(path.join(os.tmpdir(), 'ssss-lease-'));
+  try {
+    const engine = createEngine({ registryDir: REGISTRY_DIR, leaseStore });
+    const workflowPath = 'workflows/nested.md';
+    const createRes = engine.processOperation({
+      type: 'operation',
+      idempotency_key: 'nested-create',
+      workspace_id: 'ws-reg',
+      path: workflowPath,
+      actor: { role: 'system' },
+      content: [
+        '---',
+        'type: workflow',
+        'title: Nested Workflow',
+        'description: Exercises nested frontmatter patch serialization.',
+        'timestamp: 2026-07-02T00:00:00Z',
+        'name: Nested Workflow',
+        'triggers:',
+        '  - type: cron',
+        '    id: morning',
+        '    cron: "0 8 * * *"',
+        '    timezone: "America/Denver"',
+        '---',
+        '',
+        'Body.',
+        '',
+      ].join('\n'),
+    }, vault);
+    check('nested frontmatter fixture commits before patch', createRes.success === true, JSON.stringify(createRes.validation?.errors || []));
+
+    const patchRes = engine.processOperation({
+      type: 'patch',
+      idempotency_key: 'nested-patch',
+      workspace_id: 'ws-reg',
+      path: workflowPath,
+      actor: { role: 'system' },
+      patches: { description: 'Patched without dropping triggers.' },
+    }, vault);
+    const patched = fs.readFileSync(path.join(vault, workflowPath), 'utf8');
+    const patchedData = parseDocument(patched).data;
+    check('patch preserves nested frontmatter arrays of maps',
+      patchRes.success === true && Array.isArray(patchedData.triggers) && patchedData.triggers[0]?.cron === '0 8 * * *',
+      patched);
+
+    const leaseTarget = 'rules/leased.md';
+    const leasePathKey = crypto.createHash('sha256').update(leaseTarget).digest('hex');
+    const leaseDir = path.join(leaseStore, 'ws-reg');
+    fs.mkdirSync(leaseDir, { recursive: true });
+    fs.writeFileSync(path.join(leaseDir, `${leasePathKey}.lease.json`), JSON.stringify({
+      lease_id: 'lease-ok',
+      expires_at: '2999-01-01T00:00:00.000Z',
+    }));
+    const leasedEnvelope = {
+      type: 'operation',
+      idempotency_key: 'lease-missing',
+      workspace_id: 'ws-reg',
+      path: leaseTarget,
+      actor: { role: 'system' },
+      content: '---\ntype: rule\ntitle: Leased\ndescription: Lease test.\ntimestamp: 2026-07-02T00:00:00Z\nname: Leased\n---\nBody.\n',
+    };
+    const missingLease = engine.processOperation(leasedEnvelope, vault);
+    check('lease conflict rejects missing lease_id', missingLease.success === false && missingLease.validation.errors.some((e) => e.includes('leased')));
+
+    const mismatchLease = engine.processOperation({ ...leasedEnvelope, idempotency_key: 'lease-mismatch', lease_id: 'wrong' }, vault);
+    check('lease conflict rejects mismatched lease_id', mismatchLease.success === false && mismatchLease.validation.errors.some((e) => e.includes('Lease mismatch')));
+
+    const matchedLease = engine.processOperation({ ...leasedEnvelope, idempotency_key: 'lease-match', lease_id: 'lease-ok' }, vault);
+    check('lease allows matching lease_id', matchedLease.success === true, JSON.stringify(matchedLease.validation?.errors || []));
+
+    const expiredTarget = 'rules/expired.md';
+    const expiredPathKey = crypto.createHash('sha256').update(expiredTarget).digest('hex');
+    fs.writeFileSync(path.join(leaseDir, `${expiredPathKey}.lease.json`), JSON.stringify({
+      lease_id: 'expired',
+      expires_at: '2000-01-01T00:00:00.000Z',
+    }));
+    const expiredLease = engine.processOperation({ ...leasedEnvelope, idempotency_key: 'lease-expired', path: expiredTarget }, vault);
+    check('expired lease does not block writes', expiredLease.success === true, JSON.stringify(expiredLease.validation?.errors || []));
+
+    const unreadableTarget = 'rules/unreadable.md';
+    const unreadablePathKey = crypto.createHash('sha256').update(unreadableTarget).digest('hex');
+    fs.writeFileSync(path.join(leaseDir, `${unreadablePathKey}.lease.json`), '{not json');
+    const unreadableLease = engine.processOperation({ ...leasedEnvelope, idempotency_key: 'lease-unreadable', path: unreadableTarget }, vault);
+    check('unreadable lease state fails closed', unreadableLease.success === false && unreadableLease.validation.errors.some((e) => e.includes('unreadable')));
+  } finally {
+    fs.rmSync(vault, { recursive: true, force: true });
+    fs.rmSync(leaseStore, { recursive: true, force: true });
+  }
+
+  let pass = 0;
+  for (const c of checks) {
+    if (c.cond) { pass++; console.log(`  ✅ ${c.name}`); }
+    else console.log(`  ❌ ${c.name}${c.detail ? ` — ${c.detail}` : ''}`);
+  }
+  console.log(`\n  ${pass}/${checks.length} operation regression checks passed (§6/§7)`);
+  return pass === checks.length;
+}
+
+function runCliSmokeConformance() {
+  const checks = [];
+  const check = (name, cond, detail = '') => { checks.push({ name, cond, detail }); };
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ssss-cli-smoke-'));
+  try {
+    const starter = path.join(tmp, 'starter');
+    execFileSync('node', [path.join(__dirname, 'ssss.mjs'), 'new', starter, '--no-git'], { stdio: 'ignore' });
+    const vault = path.join(starter, 'vault');
+    const files = [];
+    (function walk(dir) {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const abs = path.join(dir, entry.name);
+        if (entry.isDirectory()) walk(abs);
+        else if (entry.name.endsWith('.md')) files.push(abs);
+      }
+    })(vault);
+    const engine = createEngine({ registryDir: REGISTRY_DIR });
+    const failures = [];
+    for (const abs of files) {
+      const rel = path.relative(vault, abs);
+      const res = engine.processOperation({
+        type: 'operation',
+        idempotency_key: `scaffold-${rel.replace(/[^A-Za-z0-9._-]/g, '_')}`,
+        workspace_id: 'ws-scaffold',
+        path: rel,
+        content: fs.readFileSync(abs, 'utf8'),
+        dry_run: true,
+        actor: { role: 'system' },
+      }, vault);
+      if (!res.success) failures.push({ rel, errors: res.validation?.errors || [] });
+    }
+    check('ssss new starter vault files validate against the registry', files.length > 0 && failures.length === 0, JSON.stringify(failures));
+
+    const dryRunVault = path.join(tmp, 'dry-run-vault');
+    const dryRunOut = execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'import',
+      REFERENCE_BUNDLE,
+      '--vault',
+      dryRunVault,
+      '--param',
+      'business_name=Demo',
+      '--param',
+      'domain=demo.example',
+      '--dry-run',
+    ], { encoding: 'utf8' });
+    const dryRunFiles = [];
+    if (fs.existsSync(dryRunVault)) {
+      (function walkDryRun(dir) {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+          const abs = path.join(dir, entry.name);
+          if (entry.isDirectory()) walkDryRun(abs);
+          else if (entry.isFile()) dryRunFiles.push(abs);
+        }
+      })(dryRunVault);
+    }
+    check('ssss import --dry-run reports would-commit counts and leaves target empty',
+      dryRunOut.includes('would commit') && dryRunFiles.length === 0,
+      dryRunOut.trim());
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+
+  let pass = 0;
+  for (const c of checks) {
+    if (c.cond) { pass++; console.log(`  ✅ ${c.name}`); }
+    else console.log(`  ❌ ${c.name}${c.detail ? ` — ${c.detail}` : ''}`);
+  }
+  console.log(`\n  ${pass}/${checks.length} CLI smoke checks passed`);
+  return pass === checks.length;
+}
+
 /**
  * Runtime conformance (spec §11.8). Proves that a conformant daemon can treat
  * workflow frontmatter as the canonical schedule source, then derive trigger,
@@ -395,9 +591,13 @@ async function main() {
     const engineOk = runAgainstEngine(doc);
     console.log('\nRunning workflow runtime conformance (src/runtime.mjs, §11.8) ...');
     const runtimeOk = runRuntimeConformance();
+    console.log('\nRunning operation regression conformance (src/engine.mjs, §6/§7) ...');
+    const operationRegressionOk = runOperationContractRegressionConformance();
     console.log('\nRunning bundle/provisioning conformance (src/bundle.mjs, §16/§17) ...');
     const bundleOk = runBundleConformance();
-    process.exit(engineOk && runtimeOk && bundleOk ? 0 : 1);
+    console.log('\nRunning CLI smoke conformance (scripts/ssss.mjs) ...');
+    const cliSmokeOk = runCliSmokeConformance();
+    process.exit(engineOk && runtimeOk && operationRegressionOk && bundleOk && cliSmokeOk ? 0 : 1);
   } else {
     console.log('\nℹ  No --endpoint/--engine given; ran structural + registry validation only.');
     console.log('   Reference engine:  ssss conformance --engine');

package/scripts/ssss.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * @ssss/cli dispatcher — the `ssss` command.
+ * @gregiteen/ssss-cli dispatcher — the `ssss` command.
  *
  * Routes the first positional argument to a subcommand. The bundle/provisioning
  * commands (export/validate/inspect/provision/import/help) export a `run(argv)`
@@ -21,7 +21,7 @@ const VERSION = (() => {
   catch { return '0.0.0'; }
 })();
 
-const TOP_LEVEL_HELP = `@ssss/cli v${VERSION} — Structured Semantic Syntax System
+const TOP_LEVEL_HELP = `@gregiteen/ssss-cli v${VERSION} — Structured Semantic Syntax System
 
 Usage: ssss <command> [options]
 

package/src/bundle.mjs

@@ -17,7 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { loadRegistries, resolvePortability } from './registry.mjs';
-import { parseDocument } from './frontmatter.mjs';
+import { parseDocument, serializeDocument } from './frontmatter.mjs';
 
 const PROFILE_INCLUDES = {
   backup: new Set(['structural', 'tenant_private', 'resource_bound']),
@@ -27,6 +27,13 @@ const PROFILE_INCLUDES = {
 const STEP_SYSTEMS = new Set(['workspace', 'branding', 'email', 'phone', 'domains', 'accounts', 'deployments', 'marketplace', 'tabs', 'automation']);
 const STEP_MODES = new Set(['existing', 'provision', 'install', 'generate', 'configure']);
 const PARAM_SOURCES = new Set(['user', 'llm', 'graph', 'system']);
+const RESOURCE_SYSTEM_BY_KIND = {
+  api_connection: 'automation',
+  domain: 'domains',
+  email: 'email',
+  mailbox: 'email',
+  phone: 'phone',
+};
 
 function isSafeBundlePath(p) {
   if (typeof p !== 'string' || !p || p.includes('\0')) return false;
@@ -41,6 +48,62 @@ function canonicalFiles(files) {
   return sorted.map((f) => ({ path: f.path, content: f.content }));
 }
 
+function requirementParameterKey(type, field) {
+  return `${type}_${field}`.replace(/[^A-Za-z0-9_]+/g, '_');
+}
+
+function resourceFieldParameterAliases(type, field) {
+  const aliases = [requirementParameterKey(type, field), field];
+  if (type === 'domain' && field === 'domain_name') aliases.push('domain');
+  if (type === 'phone_number' && field === 'phone_number') aliases.push('phone');
+  return aliases;
+}
+
+function ensureRequirementDeclarations(manifest, typeDef, resourceFields) {
+  const type = typeDef.type;
+  const resource = typeDef.resource || {};
+  const existingParams = new Set((manifest.parameters || []).map((p) => p.key));
+  for (const field of resourceFields) {
+    if (resourceFieldParameterAliases(type, field).some((key) => existingParams.has(key))) continue;
+    const key = requirementParameterKey(type, field);
+    if (!existingParams.has(key)) {
+      manifest.parameters.push({
+        key,
+        label: `${resource.kind || type} ${field}`.replace(/_/g, ' '),
+        type: 'string',
+        scope: 'workspace',
+        source: 'user',
+        required: false,
+        description: `Satisfies the ${type} resource requirement field '${field}'.`,
+      });
+      existingParams.add(key);
+    }
+  }
+
+  const stepId = `bind-${type}`.replace(/[^A-Za-z0-9_-]+/g, '-');
+  if (!(manifest.provisioning || []).some((s) => s.id === stepId)) {
+    manifest.provisioning.push({
+      id: stepId,
+      label: `Bind ${resource.kind || type}`,
+      system: RESOURCE_SYSTEM_BY_KIND[resource.kind] || 'accounts',
+      mode: 'provision',
+      required: true,
+      notes: resource.provision_relation || 'resource_bound requirement',
+    });
+  }
+}
+
+function reduceResourceBoundFile(file, typeDef, profile) {
+  const binds = typeDef?.resource?.binds;
+  if (!Array.isArray(binds) || binds.length === 0) {
+    throw new Error(`Cannot export resource_bound '${file.path}' in ${profile}: registry type '${typeDef?.type || '(unknown)'}' does not declare resource.binds.`);
+  }
+  const { data, body } = parseDocument(file.content);
+  const reduced = { ...data, x_portability: 'resource_bound' };
+  for (const field of binds) reduced[field] = 'REQUIREMENT';
+  return { path: file.path, content: serializeDocument(reduced, body), resourceFields: binds };
+}
+
 /** sha256 over the canonical file serialization (§16.3). */
 export function contentHash(files) {
   const pre = JSON.stringify(canonicalFiles(files));
@@ -75,10 +138,13 @@ export function exportBundle(vaultRoot, opts = {}) {
   const includes = PROFILE_INCLUDES[profile];
   if (!includes) throw new Error(`Unknown export profile '${profile}'. Use backup | template | sale.`);
 
-  const { types } = loadRegistries(registryDir);
+  const { types, core } = loadRegistries(registryDir);
   const dropped = [];
   const kept = [];
   const inventory = {};
+  const manifestParameters = [...parameters];
+  const manifestProvisioning = [...provisioning];
+  const manifestDraft = { parameters: manifestParameters, provisioning: manifestProvisioning };
 
   for (const file of walkVault(vaultRoot)) {
     const { data } = parseDocument(file.content);
@@ -86,7 +152,13 @@ export function exportBundle(vaultRoot, opts = {}) {
     const typeDef = types.get(type);
     const klass = resolvePortability(typeDef, data);
     if (!includes.has(klass)) { dropped.push({ path: file.path, type, portability: klass }); continue; }
-    kept.push(file);
+    if ((profile === 'sale' || profile === 'template') && klass === 'resource_bound') {
+      const reduced = reduceResourceBoundFile(file, typeDef, profile);
+      kept.push({ path: reduced.path, content: reduced.content });
+      ensureRequirementDeclarations(manifestDraft, typeDef, reduced.resourceFields);
+    } else {
+      kept.push(file);
+    }
     if (type) inventory[type] = (inventory[type] || 0) + 1;
   }
 
@@ -94,12 +166,12 @@ export function exportBundle(vaultRoot, opts = {}) {
   const manifest = {
     name, description, version,
     exported_at: exportedAt,
-    ssss_core_version: loadRegistries(registryDir).core.spec_version,
+    ssss_core_version: core.spec_version,
     required_extensions: requiredExtensions,
     export_profile: profile,
     primitive_inventory: inventory,
-    provisioning,
-    parameters,
+    provisioning: manifestProvisioning,
+    parameters: manifestParameters,
     file_count: files.length,
     provenance: { content_hash: contentHash(files), exporter },
   };
@@ -114,22 +186,27 @@ export function exportBundle(vaultRoot, opts = {}) {
  */
 export function validateBundle(bundle, opts = {}) {
   const errors = [];
-  const { types, core } = loadRegistries(opts.registryDir);
+  const { types, core, extensions } = loadRegistries(opts.registryDir);
   const m = bundle && bundle.manifest;
   if (!m) return { valid: false, errors: ['bundle has no manifest'] };
+  const files = Array.isArray(bundle.files) ? bundle.files : [];
 
   for (const f of core.bundle.manifest_required_fields) {
     if (m[f] === undefined || m[f] === null) errors.push(`manifest missing required field '${f}'`);
   }
+  if (!Array.isArray(bundle.files)) errors.push('bundle.files must be an array');
+  for (const ext of m.required_extensions || []) {
+    if (!extensions.has(ext)) errors.push(`required extension '${ext}' is not loaded`);
+  }
   if (!PROFILE_INCLUDES[m.export_profile]) errors.push(`invalid export_profile '${m.export_profile}'`);
   if (m.ssss_core_version && m.ssss_core_version !== core.spec_version) {
     errors.push(`bundle targets ssss_core_version ${m.ssss_core_version}; host is ${core.spec_version}`);
   }
-  if (Array.isArray(bundle.files) && m.file_count !== bundle.files.length) {
-    errors.push(`file_count ${m.file_count} ≠ actual ${bundle.files.length}`);
+  if (m.file_count !== files.length) {
+    errors.push(`file_count ${m.file_count} ≠ actual ${files.length}`);
   }
   const seenPaths = new Set();
-  for (const file of bundle.files || []) {
+  for (const file of files) {
     if (!isSafeBundlePath(file.path)) {
       errors.push(`file '${file.path || '(missing)'}' has an unsafe bundle path`);
       continue;
@@ -142,7 +219,7 @@ export function validateBundle(bundle, opts = {}) {
     for (const f of core.bundle.provenance_required_fields) {
       if (m.provenance[f] === undefined) errors.push(`provenance missing '${f}'`);
     }
-    const recomputed = contentHash(bundle.files || []);
+    const recomputed = contentHash(files);
     if (m.provenance.content_hash && m.provenance.content_hash !== recomputed) {
       errors.push(`content_hash mismatch: manifest ${m.provenance.content_hash} ≠ recomputed ${recomputed}`);
     }
@@ -150,7 +227,7 @@ export function validateBundle(bundle, opts = {}) {
   // Portability conformance: no file may exceed what the profile permits (§5.5).
   const includes = PROFILE_INCLUDES[m.export_profile];
   if (includes) {
-    for (const file of bundle.files || []) {
+    for (const file of files) {
       if (!isSafeBundlePath(file.path)) continue;
       const base = path.basename(file.path || '');
       if (base === 'index.md' || base === 'log.md') continue;
@@ -175,6 +252,17 @@ export function validateBundle(bundle, opts = {}) {
       if (!includes.has(klass)) {
         errors.push(`file '${file.path}' is ${klass}, excluded by profile '${m.export_profile}'`);
       }
+      if ((m.export_profile === 'sale' || m.export_profile === 'template') && klass === 'resource_bound') {
+        const binds = def.resource?.binds || [];
+        if (!binds.length) {
+          errors.push(`file '${file.path}' is resource_bound but registry type '${data.type}' declares no resource.binds`);
+        }
+        for (const field of binds) {
+          if (data[field] !== 'REQUIREMENT') {
+            errors.push(`file '${file.path}' leaks resource_bound field '${field}' in ${m.export_profile} bundle`);
+          }
+        }
+      }
     }
   }
   // Provisioning step + parameter vocabularies (§17.2 / §16.5).
@@ -256,6 +344,7 @@ export function provisionBundle(bundle, opts = {}) {
 export function importBundle(plan, vaultRoot, engine) {
   const results = [];
   for (const env of plan) results.push(engine.processOperation(env, vaultRoot));
-  const committed = results.filter((r) => r.success && !r.replay).length;
-  return { ok: results.every((r) => r.success), committed, results };
+  const committed = results.filter((r) => r.success && !r.replay && !r.dry_run).length;
+  const wouldCommit = results.filter((r) => r.success && !r.replay && r.dry_run).length;
+  return { ok: results.every((r) => r.success), committed, wouldCommit, results };
 }

package/src/frontmatter.mjs

@@ -3,9 +3,10 @@
  *
  * SSSS files are Markdown with a leading `---`-fenced YAML frontmatter block
  * (spec §4.1). The canonical engine avoids a YAML dependency: it parses the
- * subset SSSS actually uses — top-level scalars, inline `[a, b]` arrays, block
- * `- item` arrays, and block scalars — which is sufficient to resolve a file's
- * `type` and validate field presence against the registry (§5, §9).
+ * subset SSSS actually uses — scalars, inline `[a, b]` arrays, block `- item`
+ * arrays, nested maps, and arrays of shallow maps — which is sufficient to
+ * resolve a file's `type`, validate registry fields (§5, §9), and round-trip
+ * operation patches without dropping nested frontmatter.
  */
 
 /** Split a document into its raw frontmatter block and body. */
@@ -42,43 +43,107 @@ function coerce(raw) {
   return v;
 }
 
-/**
- * Parse a frontmatter block (the inner YAML, no fences) into an object.
- * Returns top-level keys only; nested maps are returned as `{}` placeholders
- * (presence is what the registry validator needs).
- */
-export function parseFrontmatter(fm) {
+function countIndent(line) {
+  const m = line.match(/^ */);
+  return m ? m[0].length : 0;
+}
+
+function splitKeyValue(text) {
+  const m = text.match(/^([A-Za-z0-9_]+):\s*(.*)$/);
+  return m ? { key: m[1], rest: m[2] } : null;
+}
+
+function nextSignificant(lines, start) {
+  for (let i = start; i < lines.length; i++) {
+    if (lines[i].trim() && !lines[i].trim().startsWith('#')) return i;
+  }
+  return -1;
+}
+
+function parseMap(lines, start, indent) {
   const data = {};
-  if (!fm) return data;
-  const lines = fm.split('\n');
-  for (let i = 0; i < lines.length; i++) {
+  let i = start;
+  while (i < lines.length) {
     const line = lines[i];
-    if (!line.trim() || line.trim().startsWith('#')) continue;
-    if (/^\s/.test(line)) continue; // sub-entry of a block handled below
-    const m = line.match(/^([A-Za-z0-9_]+):\s*(.*)$/);
-    if (!m) continue;
-    const key = m[1];
-    const rest = m[2];
-    if (rest === '') {
-      // Could open a block list or a nested map. Peek ahead.
-      const items = [];
-      let isList = false;
-      let j = i + 1;
-      for (; j < lines.length; j++) {
-        const sub = lines[j];
-        if (!sub.trim()) continue;
-        if (!/^\s/.test(sub)) break; // dedent → block ended
-        const li = sub.match(/^\s*-\s*(.*)$/);
-        if (li) { isList = true; items.push(coerce(li[1])); }
-        else break; // nested map; we only need presence
+    if (!line.trim() || line.trim().startsWith('#')) { i++; continue; }
+    const currentIndent = countIndent(line);
+    if (currentIndent < indent) break;
+    if (currentIndent > indent) { i++; continue; }
+    const kv = splitKeyValue(line.slice(indent));
+    if (!kv) { i++; continue; }
+    if (kv.rest !== '') {
+      data[kv.key] = coerce(kv.rest);
+      i++;
+      continue;
+    }
+
+    const next = nextSignificant(lines, i + 1);
+    if (next < 0 || countIndent(lines[next]) <= indent) {
+      data[kv.key] = {};
+      i++;
+      continue;
+    }
+    const childIndent = countIndent(lines[next]);
+    if (lines[next].slice(childIndent).startsWith('- ')) {
+      const parsed = parseList(lines, next, childIndent);
+      data[kv.key] = parsed.value;
+      i = parsed.next;
+    } else {
+      const parsed = parseMap(lines, next, childIndent);
+      data[kv.key] = parsed.value;
+      i = parsed.next;
+    }
+  }
+  return { value: data, next: i };
+}
+
+function parseList(lines, start, indent) {
+  const items = [];
+  let i = start;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (!line.trim() || line.trim().startsWith('#')) { i++; continue; }
+    const currentIndent = countIndent(line);
+    if (currentIndent < indent) break;
+    if (currentIndent > indent) { i++; continue; }
+    const item = line.slice(indent).match(/^-\s*(.*)$/);
+    if (!item) break;
+    const raw = item[1];
+    const kv = splitKeyValue(raw);
+    if (kv) {
+      const obj = { [kv.key]: kv.rest === '' ? {} : coerce(kv.rest) };
+      i++;
+      const next = nextSignificant(lines, i);
+      if (next >= 0 && countIndent(lines[next]) > indent) {
+        const parsed = parseMap(lines, next, countIndent(lines[next]));
+        Object.assign(obj, parsed.value);
+        i = parsed.next;
+      }
+      items.push(obj);
+    } else if (raw === '') {
+      const next = nextSignificant(lines, i + 1);
+      if (next >= 0 && countIndent(lines[next]) > indent) {
+        const parsed = parseMap(lines, next, countIndent(lines[next]));
+        items.push(parsed.value);
+        i = parsed.next;
+      } else {
+        items.push('');
+        i++;
       }
-      data[key] = isList ? items : {};
-      i = isList ? j - 1 : i;
     } else {
-      data[key] = coerce(rest);
+      items.push(coerce(raw));
+      i++;
     }
   }
-  return data;
+  return { value: items, next: i };
+}
+
+/**
+ * Parse a frontmatter block (the inner YAML, no fences) into an object.
+ */
+export function parseFrontmatter(fm) {
+  if (!fm) return {};
+  return parseMap(fm.split('\n'), 0, 0).value;
 }
 
 /** Parse a full document (with fences) into { data, body }. */
@@ -96,13 +161,51 @@ function serializeValue(v) {
   return s;
 }
 
+function serializeEntry(lines, key, value, indent = 0) {
+  const pad = ' '.repeat(indent);
+  if (Array.isArray(value)) {
+    if (!value.length) {
+      lines.push(`${pad}${key}: []`);
+      return;
+    }
+    lines.push(`${pad}${key}:`);
+    for (const item of value) {
+      if (item && typeof item === 'object' && !Array.isArray(item)) {
+        const entries = Object.entries(item);
+        if (!entries.length) {
+          lines.push(`${pad}  - {}`);
+          continue;
+        }
+        const [first, ...rest] = entries;
+        if (first[1] && typeof first[1] === 'object' && !Array.isArray(first[1])) {
+          lines.push(`${pad}  - ${first[0]}:`);
+          serializeObject(lines, first[1], indent + 6);
+        } else {
+          lines.push(`${pad}  - ${first[0]}: ${serializeValue(first[1])}`);
+        }
+        for (const [childKey, childValue] of rest) serializeEntry(lines, childKey, childValue, indent + 4);
+      } else {
+        lines.push(`${pad}  - ${serializeValue(item)}`);
+      }
+    }
+    return;
+  }
+  if (value && typeof value === 'object') {
+    lines.push(`${pad}${key}:`);
+    serializeObject(lines, value, indent + 2);
+    return;
+  }
+  lines.push(`${pad}${key}: ${serializeValue(value)}`);
+}
+
+function serializeObject(lines, obj, indent) {
+  for (const [k, v] of Object.entries(obj)) serializeEntry(lines, k, v, indent);
+}
+
 /** Serialize a frontmatter object + body back into an SSSS document. */
 export function serializeDocument(data, body) {
   const lines = ['---'];
-  for (const [k, v] of Object.entries(data)) {
-    if (v && typeof v === 'object' && !Array.isArray(v)) continue; // skip nested maps we can't round-trip
-    lines.push(`${k}: ${serializeValue(v)}`);
-  }
+  serializeObject(lines, data, 0);
   lines.push('---');
   const b = body == null ? '' : (body.startsWith('\n') ? body : `\n${body}`);
   return lines.join('\n') + b;

package/src/registry.mjs

@@ -20,11 +20,12 @@ const APPEND_TYPES = new Set(['conversation', 'run']);
 /**
  * Load the core registry and merge extension registries.
  * @param {string} [registryDir] - directory containing core.json + extensions/
- * @returns {{ types: Map<string, object>, contractTypes: Set<string>, portabilityClasses: string[], core: object }}
+ * @returns {{ types: Map<string, object>, contractTypes: Set<string>, portabilityClasses: string[], core: object, extensions: Set<string> }}
  */
 export function loadRegistries(registryDir = DEFAULT_REGISTRY_DIR) {
   const corePath = path.join(registryDir, 'core.json');
   const core = JSON.parse(fs.readFileSync(corePath, 'utf8'));
+  const extensions = new Set();
 
   const types = new Map();
   for (const [name, def] of Object.entries(core.document_primitives || {})) {
@@ -35,6 +36,7 @@ export function loadRegistries(registryDir = DEFAULT_REGISTRY_DIR) {
   if (fs.existsSync(extDir)) {
     for (const file of fs.readdirSync(extDir).filter((f) => f.endsWith('.json'))) {
       const ext = JSON.parse(fs.readFileSync(path.join(extDir, file), 'utf8'));
+      if (ext.registry) extensions.add(ext.registry);
       for (const [name, def] of Object.entries(ext.document_primitives || {})) {
         if (types.has(name) && types.get(name).registry === 'core') continue; // core wins; extensions MUST NOT redefine
         types.set(name, { ...def, type: name, registry: ext.registry || file });
@@ -44,7 +46,7 @@ export function loadRegistries(registryDir = DEFAULT_REGISTRY_DIR) {
 
   const contractTypes = new Set(Object.keys(core.contract_primitives || {}));
   const portabilityClasses = Object.keys(core.portability?.classes || {});
-  return { types, contractTypes, portabilityClasses, core };
+  return { types, contractTypes, portabilityClasses, core, extensions };
 }
 
 /** Is this document type append-only (events appended, never rewritten)? */