@mean-weasel/lineage 0.1.4 → 0.1.5

package/dist/server.js

@@ -1587,755 +1587,852 @@ function activeLineageWorkspaceRoot(project) {
   }
 }
 
-// src/server/assetLineage.ts
-var LineageError = class extends Error {
-  constructor(message, status = 400) {
+// src/server/agentClaims.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+var defaultTtlSeconds = 20 * 60;
+var idleAfterSeconds = 5 * 60;
+var staleAfterSeconds = 15 * 60;
+var scopes = /* @__PURE__ */ new Set(["lineage_workspace", "content_post", "content_queue_lane", "selection_set", "project_channel"]);
+var AgentClaimError = class extends Error {
+  constructor(message, status = 400, code = "agent_claim_error", conflicts = []) {
     super(message);
     this.status = status;
+    this.code = code;
+    this.conflicts = conflicts;
   }
   status;
+  code;
+  conflicts;
 };
-function isLineageError(error) {
-  return error instanceof LineageError;
+function isAgentClaimError(error) {
+  return error instanceof AgentClaimError;
 }
-function collectAssets(project, source) {
-  const first = listAssets(project, { source, page: 1, pageSize: 100 });
-  const assets = [...first.assets];
-  for (let page = 2; page <= first.pagination.totalPages; page += 1) {
-    assets.push(...listAssets(project, { source, page, pageSize: 100 }).assets);
+function parseClaimTtl(value) {
+  if (!value) return defaultTtlSeconds;
+  const match = value.trim().match(/^(\d+)(s|m|h)?$/);
+  if (!match) throw new AgentClaimError(`Invalid claim ttl: ${value}`);
+  const amount = Number(match[1]);
+  const unit = match[2] || "s";
+  const multiplier = unit === "h" ? 3600 : unit === "m" ? 60 : 1;
+  const seconds = amount * multiplier;
+  if (!Number.isInteger(seconds) || seconds < 30 || seconds > 24 * 60 * 60) {
+    throw new AgentClaimError("Claim ttl must be between 30 seconds and 24 hours");
   }
-  return assets;
+  return seconds;
 }
-function upsertProject(database, project) {
+function randomId(prefix) {
+  return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
+}
+function tokenHash(token) {
+  return createHash2("sha256").update(token).digest("hex");
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function expiresAtFrom(timestamp, ttlSeconds) {
+  return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
+}
+function metadataJson(metadata2) {
+  return metadata2 ? JSON.stringify(metadata2) : null;
+}
+function parseMetadata(value) {
+  if (typeof value !== "string" || !value) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function derivedState(row, now = /* @__PURE__ */ new Date()) {
+  if (row.status !== "active") return row.status === "expired" ? "expired" : "stale";
+  if (new Date(row.expires_at).getTime() <= now.getTime()) return "expired";
+  const ageSeconds = Math.max(0, Math.floor((now.getTime() - new Date(row.heartbeat_at).getTime()) / 1e3));
+  if (ageSeconds >= staleAfterSeconds) return "stale";
+  if (ageSeconds >= idleAfterSeconds) return "idle";
+  return "active";
+}
+function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
+  const heartbeatAt = String(row.heartbeat_at);
+  return {
+    id: String(row.id),
+    project: String(row.project_id),
+    channel: typeof row.channel === "string" ? row.channel : void 0,
+    scope_type: String(row.scope_type),
+    target_id: String(row.target_id),
+    target_title: typeof row.target_title === "string" ? row.target_title : void 0,
+    agent_id: typeof row.agent_id === "string" ? row.agent_id : void 0,
+    agent_name: String(row.agent_name),
+    agent_kind: String(row.agent_kind),
+    thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
+    status: String(row.status),
+    created_at: String(row.created_at),
+    heartbeat_at: heartbeatAt,
+    expires_at: String(row.expires_at),
+    released_at: typeof row.released_at === "string" ? row.released_at : void 0,
+    revoked_at: typeof row.revoked_at === "string" ? row.revoked_at : void 0,
+    revoked_by: typeof row.revoked_by === "string" ? row.revoked_by : void 0,
+    override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
+    metadata: parseMetadata(row.metadata_json),
+    heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
+    derived_state: derivedState({
+      expires_at: String(row.expires_at),
+      heartbeat_at: heartbeatAt,
+      status: String(row.status)
+    }, now)
+  };
+}
+function eventToRow(row) {
+  return {
+    claim_id: String(row.claim_id),
+    event_type: String(row.event_type),
+    actor: typeof row.actor === "string" ? row.actor : void 0,
+    message: typeof row.message === "string" ? row.message : void 0,
+    created_at: String(row.created_at),
+    metadata: parseMetadata(row.metadata_json)
+  };
+}
+function ensureProject3(database, project) {
   const timestamp = nowIso();
   database.prepare(`
-    insert into projects (id, product, catalog_path, created_at, updated_at)
-    values (?, ?, ?, ?, ?)
+    insert into projects (id, product, created_at, updated_at)
+    values (?, ?, ?, ?)
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, join5(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+  `).run(project, project, timestamp, timestamp);
 }
-function upsertAsset(database, project, asset) {
-  const timestamp = nowIso();
-  const source = asset.source === "local" ? "local" : "catalog";
-  database.prepare(`
-    insert into assets (
-      id, project_id, source, local_path, s3_key, checksum_sha256, media_type, title, status,
-      channel, campaign, audience, size_bytes, content_type, created_at, updated_at, last_seen_at
-    ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    on conflict(id) do update set
-      source = excluded.source, local_path = excluded.local_path, s3_key = excluded.s3_key,
-      checksum_sha256 = excluded.checksum_sha256, media_type = excluded.media_type,
-      title = excluded.title, status = excluded.status, channel = excluded.channel,
-      campaign = excluded.campaign, audience = excluded.audience, size_bytes = excluded.size_bytes,
-      content_type = excluded.content_type, updated_at = excluded.updated_at, last_seen_at = excluded.last_seen_at
-  `).run(
-    asset.asset_id,
-    project,
-    source,
-    asset.local?.relative_path || null,
-    asset.s3?.key || null,
-    asset.local?.checksum_sha256 || asset.s3?.checksum_sha256 || null,
-    asset.content_type,
-    asset.title,
-    asset.status,
-    asset.channel || null,
-    asset.campaign || null,
-    asset.audience || null,
-    asset.local?.size_bytes || asset.s3?.size_bytes || null,
-    asset.local?.content_type || asset.s3?.content_type || null,
-    timestamp,
-    timestamp,
-    timestamp
-  );
+function recordEvent(database, claimId, eventType, actor, message, metadata2) {
   database.prepare(`
-    insert into asset_reviews (asset_id, review_state, updated_at)
-    values (?, 'unreviewed', ?)
-    on conflict(asset_id) do nothing
-  `).run(asset.asset_id, timestamp);
+    insert into agent_claim_events (id, claim_id, event_type, actor, message, created_at, metadata_json)
+    values (?, ?, ?, ?, ?, ?, ?)
+  `).run(randomId("claim_event"), claimId, eventType, actor || null, message || null, nowIso(), metadataJson(metadata2));
 }
-function indexLineageAssets(project = defaultProject) {
-  const database = lineageDb();
-  const catalog = collectAssets(project, "catalog");
-  const local = collectAssets(project, "local");
-  upsertProject(database, project);
-  for (const asset of [...catalog, ...local]) upsertAsset(database, project, asset);
-  database.close();
-  return { catalog: catalog.length, local: local.length, total: catalog.length + local.length, database: lineageDbPath() };
+function expireActiveClaims(database) {
+  const timestamp = nowIso();
+  const expired = database.prepare(`
+    select id from agent_claims where status = 'active' and expires_at <= ?
+  `).all(timestamp);
+  if (expired.length === 0) return;
+  database.prepare(`
+    update agent_claims set status = 'expired' where status = 'active' and expires_at <= ?
+  `).run(timestamp);
+  for (const claim of expired) recordEvent(database, claim.id, "expired", "system", "Claim expired after missed heartbeat.");
 }
-function requireAsset2(database, project, assetId) {
-  const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
-  if (!row) throw new LineageError(`Unknown indexed asset: ${assetId}`, 404);
+function normalizeScope(scopeType) {
+  if (!scopes.has(scopeType)) throw new AgentClaimError(`Unsupported claim scope: ${scopeType}`);
+  return scopeType;
 }
-function parentOf(database, project, assetId) {
-  const row = database.prepare("select parent_asset_id from asset_edges where project_id = ? and child_asset_id = ? order by created_at limit 1").get(project, assetId);
-  return row?.parent_asset_id;
+function channelOverlaps(left, right) {
+  return !left || !right || left === right;
 }
-function rootFor(database, project, assetId) {
-  let root = assetId;
-  const seen = /* @__PURE__ */ new Set();
-  while (!seen.has(root)) {
-    seen.add(root);
-    const parent = parentOf(database, project, root);
-    if (!parent) return root;
-    root = parent;
-  }
-  return assetId;
+function claimOverlaps(candidate, existing) {
+  if (candidate.project !== existing.project) return false;
+  if (!channelOverlaps(candidate.channel, existing.channel)) return false;
+  if (candidate.scope_type === existing.scope_type && candidate.target_id === existing.target_id) return true;
+  return candidate.scope_type === "project_channel" || existing.scope_type === "project_channel";
 }
-function latestSelectedRoot(database, project) {
-  const row = database.prepare("select root_asset_id from asset_selections where project_id = ? order by selected_at desc limit 1").get(project);
-  return row?.root_asset_id;
+function activeClaims(database, project) {
+  const rows = project ? database.prepare("select * from agent_claims where project_id = ? and status = 'active' order by heartbeat_at desc").all(project) : database.prepare("select * from agent_claims where status = 'active' order by project_id, heartbeat_at desc").all();
+  return rows.map((row) => rowToClaim(row));
 }
-function resolveRoot(database, project, rootAssetId) {
-  if (rootAssetId) {
-    requireAsset2(database, project, rootAssetId);
-    return rootAssetId;
-  }
-  const root = activeLineageWorkspaceRoot(project) || latestSelectedRoot(database, project);
-  if (!root) throw new LineageError("Lineage command requires --root unless a project selection exists");
-  requireAsset2(database, project, root);
-  return root;
+function findClaimById(database, claimId, project) {
+  const row = project ? database.prepare("select * from agent_claims where project_id = ? and id = ?").get(project, claimId) : database.prepare("select * from agent_claims where id = ?").get(claimId);
+  return row ? rowToClaim(row) : null;
 }
-function edgeId(project, parent, child) {
-  return `${project}:${parent}:derived_from:${child}`;
+function findClaimRowByToken(database, claimToken) {
+  const claimId = claimToken.split(".")[0];
+  const row = database.prepare("select * from agent_claims where id = ?").get(claimId);
+  if (!row) return null;
+  return safeEqual(String(row.token_hash), tokenHash(claimToken)) ? row : null;
 }
-function canPreviewLocally(mediaType, localPath) {
-  return Boolean(localPath && ["image", "video", "gif"].includes(mediaType));
+function denied(code, message, conflicts = []) {
+  return { ok: false, code, message, conflicts };
 }
-function localPreviewUrl(project, localPath) {
-  if (!localPath) return void 0;
-  const params = new URLSearchParams({ project, path: localPath });
-  return `/api/assets/local-preview?${params.toString()}`;
+function scopeAllowsWrite(claim, scopeType, targetId, writeKind) {
+  if (claim.scope_type === scopeType && claim.target_id === targetId) return true;
+  if (claim.scope_type === "project_channel") return true;
+  if (claim.scope_type === "lineage_workspace" && scopeType === "lineage_workspace") return claim.target_id === targetId;
+  if (claim.scope_type === "content_queue_lane" && writeKind === "content_queue_next") return true;
+  return false;
 }
-function linkLineageAssets(project, fields) {
+function createAgentClaim(fields) {
+  const project = fields.project.trim();
+  const targetId = fields.targetId.trim();
+  const agentName = fields.agentName.trim();
+  if (!project) throw new AgentClaimError("Agent claim requires project");
+  if (!targetId) throw new AgentClaimError("Agent claim requires target");
+  if (!agentName) throw new AgentClaimError("Agent claim requires agent name");
+  const scopeType = normalizeScope(fields.scopeType);
+  const ttlSeconds = fields.ttlSeconds || defaultTtlSeconds;
   const database = lineageDb();
-  requireAsset2(database, project, fields.parentAssetId);
-  requireAsset2(database, project, fields.childAssetId);
-  if (fields.parentAssetId === fields.childAssetId) throw new LineageError("Lineage link cannot point to itself");
-  const edge = {
-    id: edgeId(project, fields.parentAssetId, fields.childAssetId),
-    parent_asset_id: fields.parentAssetId,
-    child_asset_id: fields.childAssetId,
-    relation_type: "derived_from",
-    created_at: nowIso()
-  };
-  if (!fields.confirmWrite) {
+  try {
+    ensureProject3(database, project);
+    expireActiveClaims(database);
+    const candidate = { project, channel: fields.channel?.trim() || void 0, scope_type: scopeType, target_id: targetId };
+    const conflicts = activeClaims(database, project).filter((claim2) => claimOverlaps(candidate, claim2));
+    if (conflicts.length > 0 && !fields.force) {
+      throw new AgentClaimError("Target already has an active overlapping agent claim.", 409, "target_already_claimed", conflicts);
+    }
+    if (conflicts.length > 0 && !fields.reason?.trim()) {
+      throw new AgentClaimError("Overriding an active claim requires --reason.", 400, "override_reason_required", conflicts);
+    }
+    const timestamp = nowIso();
+    for (const conflict of conflicts) {
+      database.prepare(`
+        update agent_claims
+        set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+        where id = ? and status = 'active'
+      `).run(timestamp, agentName, fields.reason || null, conflict.id);
+      recordEvent(database, conflict.id, "revoked", agentName, fields.reason || "Revoked by forced claim takeover.");
+      recordEvent(database, conflict.id, "conflict", agentName, `Overridden by ${agentName}.`, { new_claim_target: targetId });
+    }
+    const id = randomId("claim");
+    const secret = randomBytes(24).toString("base64url");
+    const claimToken = `${id}.${secret}`;
+    const expiresAt = expiresAtFrom(timestamp, ttlSeconds);
+    database.prepare(`
+      insert into agent_claims (
+        id, token_hash, project_id, channel, scope_type, target_id, target_title, agent_id, agent_name,
+        agent_kind, thread_id, status, created_at, heartbeat_at, expires_at, metadata_json
+      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)
+    `).run(
+      id,
+      tokenHash(claimToken),
+      project,
+      candidate.channel || null,
+      scopeType,
+      targetId,
+      fields.targetTitle?.trim() || null,
+      fields.agentId?.trim() || null,
+      agentName,
+      fields.agentKind?.trim() || "codex",
+      fields.threadId?.trim() || null,
+      timestamp,
+      timestamp,
+      expiresAt,
+      metadataJson(fields.metadata)
+    );
+    recordEvent(database, id, "created", agentName, `Claimed ${scopeType} ${targetId}.`, { ttl_seconds: ttlSeconds });
+    const claim = findClaimById(database, id);
+    return { ok: true, claim, claim_token: claimToken, conflicts_revoked: conflicts.map((conflict) => conflict.id) };
+  } finally {
     database.close();
-    return { ok: true, dryRun: true, edge };
   }
-  database.prepare(`
-    insert into asset_edges (id, project_id, parent_asset_id, child_asset_id, relation_type, created_at)
-    values (?, ?, ?, ?, 'derived_from', ?)
-    on conflict(project_id, parent_asset_id, child_asset_id, relation_type) do nothing
-  `).run(edge.id, project, edge.parent_asset_id, edge.child_asset_id, edge.created_at);
-  database.close();
-  return { ok: true, message: `Linked ${edge.child_asset_id} from ${edge.parent_asset_id}`, edge };
 }
-function descendants(database, project, root) {
-  const edges = [];
-  const queue = [root];
-  const seen = /* @__PURE__ */ new Set();
-  while (queue.length > 0) {
-    const parent = queue.shift();
-    if (seen.has(parent)) continue;
-    seen.add(parent);
-    const rows = database.prepare("select id, parent_asset_id, child_asset_id, relation_type, created_at from asset_edges where project_id = ? and parent_asset_id = ? order by created_at").all(project, parent);
-    edges.push(...rows);
-    queue.push(...rows.map((row) => row.child_asset_id));
+function listAgentClaims(project) {
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
+    return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
+  } finally {
+    database.close();
   }
-  return edges;
 }
-function getLineageSnapshot(project, assetId) {
+function inspectAgentClaim(claimId, project) {
   const database = lineageDb();
-  requireAsset2(database, project, assetId);
-  const root = rootFor(database, project, assetId);
-  const edges = descendants(database, project, root);
-  const ids = [.../* @__PURE__ */ new Set([root, ...edges.flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id])])];
-  const placeholders2 = ids.map(() => "?").join(",");
-  const rows = database.prepare(`
-    select a.id asset_id, a.project_id project, a.source, a.title, a.media_type, a.status, a.channel, a.campaign,
-      a.local_path, a.s3_key, a.checksum_sha256, coalesce(r.review_state, 'unreviewed') review_state,
-      r.notes review_notes, l.x layout_x, l.y layout_y
-    from assets a left join asset_reviews r on r.asset_id = a.id
-      left join asset_layouts l on l.project_id = a.project_id and l.root_asset_id = ? and l.asset_id = a.id
-    where a.project_id = ? and a.id in (${placeholders2})
-  `).all(root, project, ...ids);
-  const selected = selectedRows(database, project, root);
-  const childIds = new Set(edges.map((edge) => edge.parent_asset_id));
-  const selectedIds = new Set(selected.map((row) => row.asset_id));
-  const selections = selected.map((row) => ({
-    asset_id: row.asset_id,
-    notes: row.notes || void 0,
-    position: Number(row.position || 0),
-    selected_at: row.selected_at
-  }));
-  const selection = selections[0] || null;
-  const nodes = rows.map((row) => {
-    const position = typeof row.layout_x === "number" && typeof row.layout_y === "number" ? { x: row.layout_x, y: row.layout_y } : void 0;
-    const { layout_x: _layoutX, layout_y: _layoutY, ...node } = row;
-    const nodeSelection = selections.find((item) => item.asset_id === row.asset_id);
-    return {
-      ...node,
-      is_latest: !childIds.has(row.asset_id),
-      position,
-      preview_url: canPreviewLocally(row.media_type, row.local_path) ? localPreviewUrl(project, row.local_path) : void 0,
-      selection_note: nodeSelection?.notes,
-      user_selected: selectedIds.has(row.asset_id)
-    };
-  });
-  database.close();
-  return {
-    project,
-    root_asset_id: root,
-    active_asset_id: assetId,
-    selected: selections.map((row) => row.asset_id),
-    selection,
-    selections,
-    latest: nodes.filter((node) => node.is_latest).map((node) => node.asset_id),
-    nodes,
-    edges,
-    fetchedAt: nowIso()
-  };
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
+    return { ok: true, claim, events: events.map(eventToRow) };
+  } finally {
+    database.close();
+  }
 }
-function updateLineageLayout(project, fields) {
-  if (fields.positions.length === 0) throw new LineageError("Lineage layout requires at least one position");
+function heartbeatAgentClaim(claimToken, ttlSeconds = defaultTtlSeconds) {
   const database = lineageDb();
-  requireAsset2(database, project, fields.rootAssetId);
-  for (const position of fields.positions) requireAsset2(database, project, position.assetId);
-  if (!fields.confirmWrite) {
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set heartbeat_at = ?, expires_at = ? where id = ?").run(timestamp, expiresAtFrom(timestamp, ttlSeconds), claim.id);
+    recordEvent(database, claim.id, "heartbeat", claim.agent_name, "Claim heartbeat received.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
     database.close();
-    return { ok: true, dryRun: true, root_asset_id: fields.rootAssetId, positions: fields.positions };
   }
-  const timestamp = nowIso();
-  const statement = database.prepare(`
-    insert into asset_layouts (id, project_id, root_asset_id, asset_id, x, y, updated_at)
-    values (?, ?, ?, ?, ?, ?, ?)
-    on conflict(project_id, root_asset_id, asset_id) do update set
-      x = excluded.x, y = excluded.y, updated_at = excluded.updated_at
-  `);
-  for (const position of fields.positions) {
-    statement.run(`${project}:${fields.rootAssetId}:layout:${position.assetId}`, project, fields.rootAssetId, position.assetId, position.x, position.y, timestamp);
-  }
-  database.close();
-  return { ok: true, message: `Saved ${fields.positions.length} lineage positions`, root_asset_id: fields.rootAssetId, positions: fields.positions };
 }
-function getLineageNextAsset(project, rootAssetId) {
+function releaseAgentClaim(claimToken) {
   const database = lineageDb();
-  const root = resolveRoot(database, project, rootAssetId);
-  database.close();
-  const snapshot = getLineageSnapshot(project, root);
-  const selectedNodes = snapshot.selected.map((assetId) => snapshot.nodes.find((node) => node.asset_id === assetId)).filter((node) => Boolean(node));
-  const latestNodes = snapshot.nodes.filter((node) => snapshot.latest.includes(node.asset_id));
-  const warnings = [];
-  for (const selectedNode of selectedNodes) {
-    if (selectedNode.is_latest) continue;
-    warnings.push("Selected asset is not a latest leaf; agents should treat this as an intentional branch choice.");
-  }
-  if (selectedNodes.length > 0) {
-    return {
-      project,
-      root_asset_id: snapshot.root_asset_id,
-      strategy: "selected",
-      selection_mode: selectedNodes.length > 1 ? "multiple" : "single",
-      recommended_action: "evolve_variations",
-      reason: "user_selected",
-      next_asset: selectedNodes[0],
-      next_assets: selectedNodes,
-      latest: snapshot.latest,
-      selected: snapshot.selected,
-      selection: snapshot.selection,
-      selections: snapshot.selections,
-      candidates: latestNodes,
-      warnings,
-      fetchedAt: nowIso()
-    };
-  }
-  if (latestNodes.length === 1) {
-    return {
-      project,
-      root_asset_id: snapshot.root_asset_id,
-      strategy: "single_latest",
-      selection_mode: "fallback",
-      recommended_action: "evolve_variations",
-      reason: "single_latest_fallback",
-      next_asset: latestNodes[0],
-      next_assets: [latestNodes[0]],
-      latest: snapshot.latest,
-      selected: snapshot.selected,
-      selection: snapshot.selection,
-      selections: snapshot.selections,
-      candidates: latestNodes,
-      warnings,
-      fetchedAt: nowIso()
-    };
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set status = 'released', released_at = ? where id = ?").run(timestamp, claim.id);
+    recordEvent(database, claim.id, "released", claim.agent_name, "Claim released by token holder.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
   }
-  return {
-    project,
-    root_asset_id: snapshot.root_asset_id,
-    strategy: latestNodes.length > 1 ? "ambiguous_latest" : "empty",
-    selection_mode: "none",
-    recommended_action: latestNodes.length > 1 ? "choose_next_base" : "none",
-    reason: latestNodes.length > 1 ? "multiple_latest_no_selection" : "no_lineage_candidates",
-    next_asset: null,
-    next_assets: [],
-    latest: snapshot.latest,
-    selected: snapshot.selected,
-    selection: snapshot.selection,
-    selections: snapshot.selections,
-    candidates: latestNodes,
-    warnings,
-    fetchedAt: nowIso()
-  };
 }
-function getLineageChildren(project, parentAssetId) {
-  const snapshot = getLineageSnapshot(project, parentAssetId);
-  const edges = snapshot.edges.filter((edge) => edge.parent_asset_id === parentAssetId);
-  const childIds = new Set(edges.map((edge) => edge.child_asset_id));
-  return {
-    project,
-    parent_asset_id: parentAssetId,
-    children: snapshot.nodes.filter((node) => childIds.has(node.asset_id)),
-    edges,
-    fetchedAt: nowIso()
-  };
+function releaseStaleAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Releasing a stale agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Releasing a stale agent claim requires a reason.", 400, "reason_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active" || claim.derived_state !== "stale") {
+      throw new AgentClaimError("Only stale active claims can be released without the claim token.", 409, "claim_not_stale", [claim]);
+    }
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set status = 'released', released_at = ?, revoked_by = ?, override_reason = ? where id = ?").run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "released", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
 }
-function updateSelectedAsset(project, fields) {
+function revokeAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Revoking an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Revoking an agent claim requires a reason.", 400, "reason_required");
   const database = lineageDb();
-  const inputAssetIds = normalizeSelectionInput(fields);
-  const root = fields.rootAssetId || (inputAssetIds[0] ? rootFor(database, project, inputAssetIds[0]) : "");
-  if (!root) throw new LineageError("Selection requires rootAssetId or assetId");
-  requireAsset2(database, project, root);
-  for (const assetId of inputAssetIds) requireAsset2(database, project, assetId);
-  const mode = fields.mode || "replace";
-  const limit = fields.maxSelections || LINEAGE_NEXT_VARIATION_LIMIT;
-  if (!fields.confirmWrite) {
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const timestamp = nowIso();
+    database.prepare(`
+      update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+      where id = ?
+    `).run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
     database.close();
-    return { ok: true, dryRun: true, root_asset_id: root, asset_ids: inputAssetIds, mode, clear: Boolean(fields.clear), max_selections: limit };
   }
-  const current = selectedRows(database, project, root);
-  let nextIds = current.map((row) => row.asset_id);
-  if (fields.clear) {
-    nextIds = [];
-  } else if (mode === "replace") {
-    nextIds = inputAssetIds;
-  } else if (mode === "add") {
-    nextIds = [...nextIds, ...inputAssetIds];
-  } else if (mode === "remove") {
-    nextIds = nextIds.filter((assetId) => !inputAssetIds.includes(assetId));
-  } else if (mode === "toggle") {
-    for (const assetId of inputAssetIds) {
-      nextIds = nextIds.includes(assetId) ? nextIds.filter((id) => id !== assetId) : [...nextIds, assetId];
-    }
+}
+function transferAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Transferring an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  const toAgentName = fields.toAgentName.trim();
+  if (!toAgentName) throw new AgentClaimError("Transfer requires toAgentName.", 400, "agent_name_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    database.prepare("update agent_claims set agent_name = ? where id = ?").run(toAgentName, claim.id);
+    recordEvent(database, claim.id, "transferred", fields.actor || "human", fields.reason || `Transferred claim to ${toAgentName}.`, { to_agent_name: toAgentName });
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
   }
-  nextIds = [...new Set(nextIds)];
-  if (!fields.clear && inputAssetIds.length === 0) throw new LineageError("Selection set requires assetId or assetIds");
-  if (nextIds.length > limit) throw new LineageError(`Select at most ${limit} assets for next variation`);
-  database.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, root);
-  const timestamp = nowIso();
-  const insert = database.prepare(`
-    insert into asset_selections (id, project_id, root_asset_id, asset_id, position, notes, selected_at)
-    values (?, ?, ?, ?, ?, ?, ?)
-  `);
-  nextIds.forEach((assetId, position) => {
-    const existing = current.find((row) => row.asset_id === assetId);
-    const notes = inputAssetIds.includes(assetId) ? fields.notes || existing?.notes : existing?.notes;
-    insert.run(selectionId(project, root, assetId), project, root, assetId, position, notes || null, timestamp);
-  });
-  database.close();
-  const message = nextIds.length === 0 ? `Cleared selected assets for ${root}` : `Selected ${nextIds.length} asset${nextIds.length === 1 ? "" : "s"} for ${root}`;
-  return { ok: true, message, root_asset_id: root, asset_id: nextIds[0] || null, asset_ids: nextIds, mode };
 }
-function updateAssetReview(project, fields) {
-  const allowed = /* @__PURE__ */ new Set(["unreviewed", "approved", "needs_revision", "rejected", "ignored"]);
-  if (!allowed.has(fields.reviewState)) throw new LineageError(`Unsupported review state: ${fields.reviewState}`);
+function validateAgentClaimForWrite(fields) {
+  if (fields.dangerLevel === "danger" && !fields.confirmWrite) {
+    return denied("human_confirmation_required", "Dangerous write requires explicit human confirmation.");
+  }
+  if (!fields.claimToken) return denied("claim_required", "Mutating agent write requires a matching claim token.");
   const database = lineageDb();
-  requireAsset2(database, project, fields.assetId);
-  if (!fields.confirmWrite) {
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, fields.claimToken);
+    if (!row) return denied("claim_token_invalid", "Unknown or invalid claim token.");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") return denied("claim_not_active", `Agent claim is ${claim.status}.`);
+    if (new Date(claim.expires_at).getTime() <= Date.now()) return denied("claim_expired", "Agent claim has expired.");
+    if (claim.project !== fields.project) return denied("claim_project_mismatch", `Claim project ${claim.project} does not match ${fields.project}.`, [claim]);
+    if (fields.channel && claim.channel && claim.channel !== fields.channel) {
+      return denied("claim_channel_mismatch", `Claim channel ${claim.channel} does not match ${fields.channel}.`, [claim]);
+    }
+    if (!scopeAllowsWrite(claim, fields.scopeType, fields.targetId, fields.writeKind)) {
+      return denied("claim_scope_mismatch", `Claim does not cover ${fields.scopeType} ${fields.targetId}.`, [claim]);
+    }
+    recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
+      danger_level: fields.dangerLevel,
+      target_id: fields.targetId,
+      write_kind: fields.writeKind
+    });
+    return { ok: true, claim, warnings: [] };
+  } finally {
     database.close();
-    return { ok: true, dryRun: true, asset_id: fields.assetId, review_state: fields.reviewState, notes: fields.notes };
   }
-  const timestamp = nowIso();
-  database.prepare(`
-    insert into asset_reviews (asset_id, review_state, reviewed_at, ignored_at, notes, updated_at)
-    values (?, ?, ?, ?, ?, ?)
-    on conflict(asset_id) do update set
-      review_state = excluded.review_state, reviewed_at = excluded.reviewed_at,
-      ignored_at = excluded.ignored_at, notes = excluded.notes, updated_at = excluded.updated_at
-  `).run(fields.assetId, fields.reviewState, timestamp, fields.reviewState === "ignored" ? timestamp : null, fields.notes || null, timestamp);
-  database.close();
-  return { ok: true, message: `Marked ${fields.assetId} ${fields.reviewState}`, asset_id: fields.assetId, review_state: fields.reviewState };
 }
 
-// src/server/agentClaims.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
-var defaultTtlSeconds = 20 * 60;
-var idleAfterSeconds = 5 * 60;
-var staleAfterSeconds = 15 * 60;
-var scopes = /* @__PURE__ */ new Set(["lineage_workspace", "content_post", "content_queue_lane", "selection_set", "project_channel"]);
-var AgentClaimError = class extends Error {
-  constructor(message, status = 400, code = "agent_claim_error", conflicts = []) {
+// src/server/lineageClaimGuards.ts
+function channelOverlaps2(left, right) {
+  return !left || !right || left === right;
+}
+function hasActiveLineageWorkspaceClaim(project, targetId, channel) {
+  return listAgentClaims(project).claims.some((claim) => {
+    if (claim.project !== project || claim.status !== "active" || claim.derived_state === "expired") return false;
+    if (claim.scope_type === "lineage_workspace") return claim.target_id === targetId;
+    return claim.scope_type === "project_channel" && channelOverlaps2(channel, claim.channel);
+  });
+}
+function requireLineageWorkspaceClaimForWrite(fields) {
+  if (!fields.confirmWrite) return;
+  const targetId = lineageWorkspaceId(fields.project, fields.rootAssetId);
+  if (!fields.claimToken && !hasActiveLineageWorkspaceClaim(fields.project, targetId, fields.channel)) return;
+  const validation = validateAgentClaimForWrite({
+    channel: fields.channel,
+    claimToken: fields.claimToken,
+    confirmWrite: fields.confirmWrite,
+    dangerLevel: "enforce",
+    project: fields.project,
+    scopeType: "lineage_workspace",
+    targetId,
+    writeKind: fields.writeKind
+  });
+  if (!validation.ok) {
+    const status = validation.code === "claim_required" || validation.code === "claim_token_invalid" ? 401 : 409;
+    throw new AgentClaimError(validation.message, status, validation.code, validation.conflicts);
+  }
+}
+
+// src/server/assetLineage.ts
+var LineageError = class extends Error {
+  constructor(message, status = 400) {
     super(message);
     this.status = status;
-    this.code = code;
-    this.conflicts = conflicts;
   }
   status;
-  code;
-  conflicts;
 };
-function isAgentClaimError(error) {
-  return error instanceof AgentClaimError;
-}
-function parseClaimTtl(value) {
-  if (!value) return defaultTtlSeconds;
-  const match = value.trim().match(/^(\d+)(s|m|h)?$/);
-  if (!match) throw new AgentClaimError(`Invalid claim ttl: ${value}`);
-  const amount = Number(match[1]);
-  const unit = match[2] || "s";
-  const multiplier = unit === "h" ? 3600 : unit === "m" ? 60 : 1;
-  const seconds = amount * multiplier;
-  if (!Number.isInteger(seconds) || seconds < 30 || seconds > 24 * 60 * 60) {
-    throw new AgentClaimError("Claim ttl must be between 30 seconds and 24 hours");
-  }
-  return seconds;
-}
-function randomId(prefix) {
-  return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
-}
-function tokenHash(token) {
-  return createHash2("sha256").update(token).digest("hex");
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function expiresAtFrom(timestamp, ttlSeconds) {
-  return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
-}
-function metadataJson(metadata2) {
-  return metadata2 ? JSON.stringify(metadata2) : null;
+function isLineageError(error) {
+  return error instanceof LineageError;
 }
-function parseMetadata(value) {
-  if (typeof value !== "string" || !value) return void 0;
-  try {
-    const parsed = JSON.parse(value);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
-  } catch {
-    return void 0;
+function collectAssets(project, source) {
+  const first = listAssets(project, { source, page: 1, pageSize: 100 });
+  const assets = [...first.assets];
+  for (let page = 2; page <= first.pagination.totalPages; page += 1) {
+    assets.push(...listAssets(project, { source, page, pageSize: 100 }).assets);
   }
+  return assets;
 }
-function derivedState(row, now = /* @__PURE__ */ new Date()) {
-  if (row.status !== "active") return row.status === "expired" ? "expired" : "stale";
-  if (new Date(row.expires_at).getTime() <= now.getTime()) return "expired";
-  const ageSeconds = Math.max(0, Math.floor((now.getTime() - new Date(row.heartbeat_at).getTime()) / 1e3));
-  if (ageSeconds >= staleAfterSeconds) return "stale";
-  if (ageSeconds >= idleAfterSeconds) return "idle";
-  return "active";
-}
-function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
-  const heartbeatAt = String(row.heartbeat_at);
-  return {
-    id: String(row.id),
-    project: String(row.project_id),
-    channel: typeof row.channel === "string" ? row.channel : void 0,
-    scope_type: String(row.scope_type),
-    target_id: String(row.target_id),
-    target_title: typeof row.target_title === "string" ? row.target_title : void 0,
-    agent_id: typeof row.agent_id === "string" ? row.agent_id : void 0,
-    agent_name: String(row.agent_name),
-    agent_kind: String(row.agent_kind),
-    thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
-    status: String(row.status),
-    created_at: String(row.created_at),
-    heartbeat_at: heartbeatAt,
-    expires_at: String(row.expires_at),
-    released_at: typeof row.released_at === "string" ? row.released_at : void 0,
-    revoked_at: typeof row.revoked_at === "string" ? row.revoked_at : void 0,
-    revoked_by: typeof row.revoked_by === "string" ? row.revoked_by : void 0,
-    override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
-    metadata: parseMetadata(row.metadata_json),
-    heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
-    derived_state: derivedState({
-      expires_at: String(row.expires_at),
-      heartbeat_at: heartbeatAt,
-      status: String(row.status)
-    }, now)
-  };
-}
-function eventToRow(row) {
-  return {
-    claim_id: String(row.claim_id),
-    event_type: String(row.event_type),
-    actor: typeof row.actor === "string" ? row.actor : void 0,
-    message: typeof row.message === "string" ? row.message : void 0,
-    created_at: String(row.created_at),
-    metadata: parseMetadata(row.metadata_json)
-  };
-}
-function ensureProject3(database, project) {
+function upsertProject(database, project) {
   const timestamp = nowIso();
   database.prepare(`
-    insert into projects (id, product, created_at, updated_at)
-    values (?, ?, ?, ?)
+    insert into projects (id, product, catalog_path, created_at, updated_at)
+    values (?, ?, ?, ?, ?)
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, timestamp, timestamp);
-}
-function recordEvent(database, claimId, eventType, actor, message, metadata2) {
-  database.prepare(`
-    insert into agent_claim_events (id, claim_id, event_type, actor, message, created_at, metadata_json)
-    values (?, ?, ?, ?, ?, ?, ?)
-  `).run(randomId("claim_event"), claimId, eventType, actor || null, message || null, nowIso(), metadataJson(metadata2));
+  `).run(project, project, join5(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
 }
-function expireActiveClaims(database) {
+function upsertAsset(database, project, asset) {
   const timestamp = nowIso();
-  const expired = database.prepare(`
-    select id from agent_claims where status = 'active' and expires_at <= ?
-  `).all(timestamp);
-  if (expired.length === 0) return;
+  const source = asset.source === "local" ? "local" : "catalog";
   database.prepare(`
-    update agent_claims set status = 'expired' where status = 'active' and expires_at <= ?
-  `).run(timestamp);
-  for (const claim of expired) recordEvent(database, claim.id, "expired", "system", "Claim expired after missed heartbeat.");
+    insert into assets (
+      id, project_id, source, local_path, s3_key, checksum_sha256, media_type, title, status,
+      channel, campaign, audience, size_bytes, content_type, created_at, updated_at, last_seen_at
+    ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    on conflict(id) do update set
+      source = excluded.source, local_path = excluded.local_path, s3_key = excluded.s3_key,
+      checksum_sha256 = excluded.checksum_sha256, media_type = excluded.media_type,
+      title = excluded.title, status = excluded.status, channel = excluded.channel,
+      campaign = excluded.campaign, audience = excluded.audience, size_bytes = excluded.size_bytes,
+      content_type = excluded.content_type, updated_at = excluded.updated_at, last_seen_at = excluded.last_seen_at
+  `).run(
+    asset.asset_id,
+    project,
+    source,
+    asset.local?.relative_path || null,
+    asset.s3?.key || null,
+    asset.local?.checksum_sha256 || asset.s3?.checksum_sha256 || null,
+    asset.content_type,
+    asset.title,
+    asset.status,
+    asset.channel || null,
+    asset.campaign || null,
+    asset.audience || null,
+    asset.local?.size_bytes || asset.s3?.size_bytes || null,
+    asset.local?.content_type || asset.s3?.content_type || null,
+    timestamp,
+    timestamp,
+    timestamp
+  );
+  database.prepare(`
+    insert into asset_reviews (asset_id, review_state, updated_at)
+    values (?, 'unreviewed', ?)
+    on conflict(asset_id) do nothing
+  `).run(asset.asset_id, timestamp);
 }
-function normalizeScope(scopeType) {
-  if (!scopes.has(scopeType)) throw new AgentClaimError(`Unsupported claim scope: ${scopeType}`);
-  return scopeType;
+function indexLineageAssets(project = defaultProject) {
+  const database = lineageDb();
+  const catalog = collectAssets(project, "catalog");
+  const local = collectAssets(project, "local");
+  upsertProject(database, project);
+  for (const asset of [...catalog, ...local]) upsertAsset(database, project, asset);
+  database.close();
+  return { catalog: catalog.length, local: local.length, total: catalog.length + local.length, database: lineageDbPath() };
 }
-function channelOverlaps(left, right) {
-  return !left || !right || left === right;
+function requireAsset2(database, project, assetId) {
+  const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
+  if (!row) throw new LineageError(`Unknown indexed asset: ${assetId}`, 404);
 }
-function claimOverlaps(candidate, existing) {
-  if (candidate.project !== existing.project) return false;
-  if (!channelOverlaps(candidate.channel, existing.channel)) return false;
-  if (candidate.scope_type === existing.scope_type && candidate.target_id === existing.target_id) return true;
-  return candidate.scope_type === "project_channel" || existing.scope_type === "project_channel";
+function parentOf(database, project, assetId) {
+  const row = database.prepare("select parent_asset_id from asset_edges where project_id = ? and child_asset_id = ? order by created_at limit 1").get(project, assetId);
+  return row?.parent_asset_id;
 }
-function activeClaims(database, project) {
-  const rows = project ? database.prepare("select * from agent_claims where project_id = ? and status = 'active' order by heartbeat_at desc").all(project) : database.prepare("select * from agent_claims where status = 'active' order by project_id, heartbeat_at desc").all();
-  return rows.map((row) => rowToClaim(row));
+function rootFor(database, project, assetId) {
+  let root = assetId;
+  const seen = /* @__PURE__ */ new Set();
+  while (!seen.has(root)) {
+    seen.add(root);
+    const parent = parentOf(database, project, root);
+    if (!parent) return root;
+    root = parent;
+  }
+  return assetId;
 }
-function findClaimById(database, claimId, project) {
-  const row = project ? database.prepare("select * from agent_claims where project_id = ? and id = ?").get(project, claimId) : database.prepare("select * from agent_claims where id = ?").get(claimId);
-  return row ? rowToClaim(row) : null;
+function explicitWorkspaceRoot(database, project, assetId) {
+  const row = database.prepare(`
+    select root_asset_id from lineage_workspaces
+    where project_id = ? and root_asset_id = ? and status != 'archived'
+  `).get(project, assetId);
+  return row?.root_asset_id;
 }
-function findClaimRowByToken(database, claimToken) {
-  const claimId = claimToken.split(".")[0];
-  const row = database.prepare("select * from agent_claims where id = ?").get(claimId);
-  if (!row) return null;
-  return safeEqual(String(row.token_hash), tokenHash(claimToken)) ? row : null;
+function nearestWorkspaceRoot(database, project, assetId) {
+  let current = assetId;
+  const seen = /* @__PURE__ */ new Set();
+  while (!seen.has(current)) {
+    seen.add(current);
+    const explicit = explicitWorkspaceRoot(database, project, current);
+    if (explicit) return explicit;
+    const parent = parentOf(database, project, current);
+    if (!parent) return current;
+    current = parent;
+  }
+  return assetId;
 }
-function denied(code, message, conflicts = []) {
-  return { ok: false, code, message, conflicts };
+function assetChannel(database, project, assetId) {
+  const row = database.prepare("select channel from assets where project_id = ? and id = ?").get(project, assetId);
+  return row?.channel;
 }
-function scopeAllowsWrite(claim, scopeType, targetId, writeKind) {
-  if (claim.scope_type === scopeType && claim.target_id === targetId) return true;
-  if (claim.scope_type === "project_channel") return true;
-  if (claim.scope_type === "lineage_workspace" && scopeType === "lineage_workspace") return claim.target_id === targetId;
-  if (claim.scope_type === "content_queue_lane" && writeKind === "content_queue_next") return true;
-  return false;
+function lineageWriteClaimContext(database, project, assetId) {
+  return {
+    channel: assetChannel(database, project, assetId),
+    rootAssetId: nearestWorkspaceRoot(database, project, assetId)
+  };
 }
-function createAgentClaim(fields) {
-  const project = fields.project.trim();
-  const targetId = fields.targetId.trim();
-  const agentName = fields.agentName.trim();
-  if (!project) throw new AgentClaimError("Agent claim requires project");
-  if (!targetId) throw new AgentClaimError("Agent claim requires target");
-  if (!agentName) throw new AgentClaimError("Agent claim requires agent name");
-  const scopeType = normalizeScope(fields.scopeType);
-  const ttlSeconds = fields.ttlSeconds || defaultTtlSeconds;
+function getLineageWriteClaimContext(project, assetId) {
   const database = lineageDb();
   try {
-    ensureProject3(database, project);
-    expireActiveClaims(database);
-    const candidate = { project, channel: fields.channel?.trim() || void 0, scope_type: scopeType, target_id: targetId };
-    const conflicts = activeClaims(database, project).filter((claim2) => claimOverlaps(candidate, claim2));
-    if (conflicts.length > 0 && !fields.force) {
-      throw new AgentClaimError("Target already has an active overlapping agent claim.", 409, "target_already_claimed", conflicts);
-    }
-    if (conflicts.length > 0 && !fields.reason?.trim()) {
-      throw new AgentClaimError("Overriding an active claim requires --reason.", 400, "override_reason_required", conflicts);
-    }
-    const timestamp = nowIso();
-    for (const conflict of conflicts) {
-      database.prepare(`
-        update agent_claims
-        set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
-        where id = ? and status = 'active'
-      `).run(timestamp, agentName, fields.reason || null, conflict.id);
-      recordEvent(database, conflict.id, "revoked", agentName, fields.reason || "Revoked by forced claim takeover.");
-      recordEvent(database, conflict.id, "conflict", agentName, `Overridden by ${agentName}.`, { new_claim_target: targetId });
-    }
-    const id = randomId("claim");
-    const secret = randomBytes(24).toString("base64url");
-    const claimToken = `${id}.${secret}`;
-    const expiresAt = expiresAtFrom(timestamp, ttlSeconds);
-    database.prepare(`
-      insert into agent_claims (
-        id, token_hash, project_id, channel, scope_type, target_id, target_title, agent_id, agent_name,
-        agent_kind, thread_id, status, created_at, heartbeat_at, expires_at, metadata_json
-      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)
-    `).run(
-      id,
-      tokenHash(claimToken),
-      project,
-      candidate.channel || null,
-      scopeType,
-      targetId,
-      fields.targetTitle?.trim() || null,
-      fields.agentId?.trim() || null,
-      agentName,
-      fields.agentKind?.trim() || "codex",
-      fields.threadId?.trim() || null,
-      timestamp,
-      timestamp,
-      expiresAt,
-      metadataJson(fields.metadata)
-    );
-    recordEvent(database, id, "created", agentName, `Claimed ${scopeType} ${targetId}.`, { ttl_seconds: ttlSeconds });
-    const claim = findClaimById(database, id);
-    return { ok: true, claim, claim_token: claimToken, conflicts_revoked: conflicts.map((conflict) => conflict.id) };
+    requireAsset2(database, project, assetId);
+    return lineageWriteClaimContext(database, project, assetId);
   } finally {
     database.close();
   }
 }
-function listAgentClaims(project) {
-  const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
-    return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
-  } finally {
-    database.close();
+function latestSelectedRoot(database, project) {
+  const row = database.prepare("select root_asset_id from asset_selections where project_id = ? order by selected_at desc limit 1").get(project);
+  return row?.root_asset_id;
+}
+function resolveRoot(database, project, rootAssetId) {
+  if (rootAssetId) {
+    requireAsset2(database, project, rootAssetId);
+    return rootAssetId;
   }
+  const root = activeLineageWorkspaceRoot(project) || latestSelectedRoot(database, project);
+  if (!root) throw new LineageError("Lineage command requires --root unless a project selection exists");
+  requireAsset2(database, project, root);
+  return root;
 }
-function inspectAgentClaim(claimId, project) {
+function edgeId(project, parent, child) {
+  return `${project}:${parent}:derived_from:${child}`;
+}
+function canPreviewLocally(mediaType, localPath) {
+  return Boolean(localPath && ["image", "video", "gif"].includes(mediaType));
+}
+function localPreviewUrl(project, localPath) {
+  if (!localPath) return void 0;
+  const params = new URLSearchParams({ project, path: localPath });
+  return `/api/assets/local-preview?${params.toString()}`;
+}
+function linkLineageAssets(project, fields) {
   const database = lineageDb();
+  requireAsset2(database, project, fields.parentAssetId);
+  requireAsset2(database, project, fields.childAssetId);
+  if (fields.parentAssetId === fields.childAssetId) throw new LineageError("Lineage link cannot point to itself");
+  const claimContext = lineageWriteClaimContext(database, project, fields.parentAssetId);
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
-    return { ok: true, claim, events: events.map(eventToRow) };
-  } finally {
+    requireLineageWorkspaceClaimForWrite({
+      channel: claimContext.channel,
+      claimToken: fields.claimToken,
+      confirmWrite: fields.confirmWrite,
+      project,
+      rootAssetId: claimContext.rootAssetId,
+      writeKind: "lineage_link"
+    });
+  } catch (error) {
     database.close();
+    throw error;
   }
-}
-function heartbeatAgentClaim(claimToken, ttlSeconds = defaultTtlSeconds) {
-  const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, claimToken);
-    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
-    const timestamp = nowIso();
-    database.prepare("update agent_claims set heartbeat_at = ?, expires_at = ? where id = ?").run(timestamp, expiresAtFrom(timestamp, ttlSeconds), claim.id);
-    recordEvent(database, claim.id, "heartbeat", claim.agent_name, "Claim heartbeat received.");
-    return { ok: true, claim: findClaimById(database, claim.id) };
-  } finally {
+  const edge = {
+    id: edgeId(project, fields.parentAssetId, fields.childAssetId),
+    parent_asset_id: fields.parentAssetId,
+    child_asset_id: fields.childAssetId,
+    relation_type: "derived_from",
+    created_at: nowIso()
+  };
+  if (!fields.confirmWrite) {
     database.close();
+    return { ok: true, dryRun: true, edge };
   }
+  database.prepare(`
+    insert into asset_edges (id, project_id, parent_asset_id, child_asset_id, relation_type, created_at)
+    values (?, ?, ?, ?, 'derived_from', ?)
+    on conflict(project_id, parent_asset_id, child_asset_id, relation_type) do nothing
+  `).run(edge.id, project, edge.parent_asset_id, edge.child_asset_id, edge.created_at);
+  database.close();
+  return { ok: true, message: `Linked ${edge.child_asset_id} from ${edge.parent_asset_id}`, edge };
 }
-function releaseAgentClaim(claimToken) {
-  const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, claimToken);
-    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
-    const timestamp = nowIso();
-    database.prepare("update agent_claims set status = 'released', released_at = ? where id = ?").run(timestamp, claim.id);
-    recordEvent(database, claim.id, "released", claim.agent_name, "Claim released by token holder.");
-    return { ok: true, claim: findClaimById(database, claim.id) };
-  } finally {
-    database.close();
+function descendants(database, project, root) {
+  const edges = [];
+  const queue = [root];
+  const seen = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const parent = queue.shift();
+    if (seen.has(parent)) continue;
+    seen.add(parent);
+    const rows = database.prepare("select id, parent_asset_id, child_asset_id, relation_type, created_at from asset_edges where project_id = ? and parent_asset_id = ? order by created_at").all(project, parent);
+    edges.push(...rows);
+    queue.push(...rows.map((row) => row.child_asset_id));
   }
+  return edges;
+}
+function getLineageSnapshot(project, assetId) {
+  const database = lineageDb();
+  requireAsset2(database, project, assetId);
+  const root = explicitWorkspaceRoot(database, project, assetId) || rootFor(database, project, assetId);
+  const edges = descendants(database, project, root);
+  const ids = [.../* @__PURE__ */ new Set([root, ...edges.flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id])])];
+  const placeholders2 = ids.map(() => "?").join(",");
+  const rows = database.prepare(`
+    select a.id asset_id, a.project_id project, a.source, a.title, a.media_type, a.status, a.channel, a.campaign,
+      a.local_path, a.s3_key, a.checksum_sha256, coalesce(r.review_state, 'unreviewed') review_state,
+      r.notes review_notes, l.x layout_x, l.y layout_y
+    from assets a left join asset_reviews r on r.asset_id = a.id
+      left join asset_layouts l on l.project_id = a.project_id and l.root_asset_id = ? and l.asset_id = a.id
+    where a.project_id = ? and a.id in (${placeholders2})
+  `).all(root, project, ...ids);
+  const selected = selectedRows(database, project, root);
+  const childIds = new Set(edges.map((edge) => edge.parent_asset_id));
+  const selectedIds = new Set(selected.map((row) => row.asset_id));
+  const selections = selected.map((row) => ({
+    asset_id: row.asset_id,
+    notes: row.notes || void 0,
+    position: Number(row.position || 0),
+    selected_at: row.selected_at
+  }));
+  const selection = selections[0] || null;
+  const nodes = rows.map((row) => {
+    const position = typeof row.layout_x === "number" && typeof row.layout_y === "number" ? { x: row.layout_x, y: row.layout_y } : void 0;
+    const { layout_x: _layoutX, layout_y: _layoutY, ...node } = row;
+    const nodeSelection = selections.find((item) => item.asset_id === row.asset_id);
+    return {
+      ...node,
+      is_latest: !childIds.has(row.asset_id),
+      position,
+      preview_url: canPreviewLocally(row.media_type, row.local_path) ? localPreviewUrl(project, row.local_path) : void 0,
+      selection_note: nodeSelection?.notes,
+      user_selected: selectedIds.has(row.asset_id)
+    };
+  });
+  database.close();
+  return {
+    project,
+    root_asset_id: root,
+    active_asset_id: assetId,
+    selected: selections.map((row) => row.asset_id),
+    selection,
+    selections,
+    latest: nodes.filter((node) => node.is_latest).map((node) => node.asset_id),
+    nodes,
+    edges,
+    fetchedAt: nowIso()
+  };
 }
-function releaseStaleAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Releasing a stale agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  if (!fields.reason?.trim()) throw new AgentClaimError("Releasing a stale agent claim requires a reason.", 400, "reason_required");
+function updateLineageLayout(project, fields) {
+  if (fields.positions.length === 0) throw new LineageError("Lineage layout requires at least one position");
   const database = lineageDb();
+  requireAsset2(database, project, fields.rootAssetId);
+  for (const position of fields.positions) requireAsset2(database, project, position.assetId);
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    if (claim.status !== "active" || claim.derived_state !== "stale") {
-      throw new AgentClaimError("Only stale active claims can be released without the claim token.", 409, "claim_not_stale", [claim]);
-    }
-    const timestamp = nowIso();
-    database.prepare("update agent_claims set status = 'released', released_at = ?, revoked_by = ?, override_reason = ? where id = ?").run(timestamp, fields.actor || "human", fields.reason, claim.id);
-    recordEvent(database, claim.id, "released", fields.actor || "human", fields.reason);
-    return { ok: true, claim: findClaimById(database, claim.id) };
-  } finally {
+    requireLineageWorkspaceClaimForWrite({
+      channel: assetChannel(database, project, fields.rootAssetId),
+      claimToken: fields.claimToken,
+      confirmWrite: fields.confirmWrite,
+      project,
+      rootAssetId: fields.rootAssetId,
+      writeKind: "lineage_layout"
+    });
+  } catch (error) {
+    database.close();
+    throw error;
+  }
+  if (!fields.confirmWrite) {
     database.close();
+    return { ok: true, dryRun: true, root_asset_id: fields.rootAssetId, positions: fields.positions };
+  }
+  const timestamp = nowIso();
+  const statement = database.prepare(`
+    insert into asset_layouts (id, project_id, root_asset_id, asset_id, x, y, updated_at)
+    values (?, ?, ?, ?, ?, ?, ?)
+    on conflict(project_id, root_asset_id, asset_id) do update set
+      x = excluded.x, y = excluded.y, updated_at = excluded.updated_at
+  `);
+  for (const position of fields.positions) {
+    statement.run(`${project}:${fields.rootAssetId}:layout:${position.assetId}`, project, fields.rootAssetId, position.assetId, position.x, position.y, timestamp);
   }
+  database.close();
+  return { ok: true, message: `Saved ${fields.positions.length} lineage positions`, root_asset_id: fields.rootAssetId, positions: fields.positions };
 }
-function revokeAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Revoking an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  if (!fields.reason?.trim()) throw new AgentClaimError("Revoking an agent claim requires a reason.", 400, "reason_required");
+function getLineageNextAsset(project, rootAssetId) {
   const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    const timestamp = nowIso();
-    database.prepare(`
-      update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
-      where id = ?
-    `).run(timestamp, fields.actor || "human", fields.reason, claim.id);
-    recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
-    return { ok: true, claim: findClaimById(database, claim.id) };
-  } finally {
-    database.close();
+  const root = resolveRoot(database, project, rootAssetId);
+  database.close();
+  const snapshot = getLineageSnapshot(project, root);
+  const selectedNodes = snapshot.selected.map((assetId) => snapshot.nodes.find((node) => node.asset_id === assetId)).filter((node) => Boolean(node));
+  const latestNodes = snapshot.nodes.filter((node) => snapshot.latest.includes(node.asset_id));
+  const warnings = [];
+  for (const selectedNode of selectedNodes) {
+    if (selectedNode.is_latest) continue;
+    warnings.push("Selected asset is not a latest leaf; agents should treat this as an intentional branch choice.");
+  }
+  if (selectedNodes.length > 0) {
+    return {
+      project,
+      root_asset_id: snapshot.root_asset_id,
+      strategy: "selected",
+      selection_mode: selectedNodes.length > 1 ? "multiple" : "single",
+      recommended_action: "evolve_variations",
+      reason: "user_selected",
+      next_asset: selectedNodes[0],
+      next_assets: selectedNodes,
+      latest: snapshot.latest,
+      selected: snapshot.selected,
+      selection: snapshot.selection,
+      selections: snapshot.selections,
+      candidates: latestNodes,
+      warnings,
+      fetchedAt: nowIso()
+    };
+  }
+  if (latestNodes.length === 1) {
+    return {
+      project,
+      root_asset_id: snapshot.root_asset_id,
+      strategy: "single_latest",
+      selection_mode: "fallback",
+      recommended_action: "evolve_variations",
+      reason: "single_latest_fallback",
+      next_asset: latestNodes[0],
+      next_assets: [latestNodes[0]],
+      latest: snapshot.latest,
+      selected: snapshot.selected,
+      selection: snapshot.selection,
+      selections: snapshot.selections,
+      candidates: latestNodes,
+      warnings,
+      fetchedAt: nowIso()
+    };
   }
+  return {
+    project,
+    root_asset_id: snapshot.root_asset_id,
+    strategy: latestNodes.length > 1 ? "ambiguous_latest" : "empty",
+    selection_mode: "none",
+    recommended_action: latestNodes.length > 1 ? "choose_next_base" : "none",
+    reason: latestNodes.length > 1 ? "multiple_latest_no_selection" : "no_lineage_candidates",
+    next_asset: null,
+    next_assets: [],
+    latest: snapshot.latest,
+    selected: snapshot.selected,
+    selection: snapshot.selection,
+    selections: snapshot.selections,
+    candidates: latestNodes,
+    warnings,
+    fetchedAt: nowIso()
+  };
 }
-function transferAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Transferring an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  const toAgentName = fields.toAgentName.trim();
-  if (!toAgentName) throw new AgentClaimError("Transfer requires toAgentName.", 400, "agent_name_required");
+function getLineageChildren(project, parentAssetId) {
+  const snapshot = getLineageSnapshot(project, parentAssetId);
+  const edges = snapshot.edges.filter((edge) => edge.parent_asset_id === parentAssetId);
+  const childIds = new Set(edges.map((edge) => edge.child_asset_id));
+  return {
+    project,
+    parent_asset_id: parentAssetId,
+    children: snapshot.nodes.filter((node) => childIds.has(node.asset_id)),
+    edges,
+    fetchedAt: nowIso()
+  };
+}
+function updateSelectedAsset(project, fields) {
   const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
-    database.prepare("update agent_claims set agent_name = ? where id = ?").run(toAgentName, claim.id);
-    recordEvent(database, claim.id, "transferred", fields.actor || "human", fields.reason || `Transferred claim to ${toAgentName}.`, { to_agent_name: toAgentName });
-    return { ok: true, claim: findClaimById(database, claim.id) };
-  } finally {
+  const inputAssetIds = normalizeSelectionInput(fields);
+  const root = fields.rootAssetId || (inputAssetIds[0] ? rootFor(database, project, inputAssetIds[0]) : "");
+  if (!root) throw new LineageError("Selection requires rootAssetId or assetId");
+  requireAsset2(database, project, root);
+  for (const assetId of inputAssetIds) requireAsset2(database, project, assetId);
+  const mode = fields.mode || "replace";
+  const limit = fields.maxSelections || LINEAGE_NEXT_VARIATION_LIMIT;
+  if (!fields.confirmWrite) {
     database.close();
+    return { ok: true, dryRun: true, root_asset_id: root, asset_ids: inputAssetIds, mode, clear: Boolean(fields.clear), max_selections: limit };
   }
-}
-function validateAgentClaimForWrite(fields) {
-  if (fields.dangerLevel === "danger" && !fields.confirmWrite) {
-    return denied("human_confirmation_required", "Dangerous write requires explicit human confirmation.");
+  const current = selectedRows(database, project, root);
+  let nextIds = current.map((row) => row.asset_id);
+  if (fields.clear) {
+    nextIds = [];
+  } else if (mode === "replace") {
+    nextIds = inputAssetIds;
+  } else if (mode === "add") {
+    nextIds = [...nextIds, ...inputAssetIds];
+  } else if (mode === "remove") {
+    nextIds = nextIds.filter((assetId) => !inputAssetIds.includes(assetId));
+  } else if (mode === "toggle") {
+    for (const assetId of inputAssetIds) {
+      nextIds = nextIds.includes(assetId) ? nextIds.filter((id) => id !== assetId) : [...nextIds, assetId];
+    }
   }
-  if (!fields.claimToken) return denied("claim_required", "Mutating agent write requires a matching claim token.");
+  nextIds = [...new Set(nextIds)];
+  if (!fields.clear && inputAssetIds.length === 0) throw new LineageError("Selection set requires assetId or assetIds");
+  if (nextIds.length > limit) throw new LineageError(`Select at most ${limit} assets for next variation`);
+  database.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, root);
+  const timestamp = nowIso();
+  const insert = database.prepare(`
+    insert into asset_selections (id, project_id, root_asset_id, asset_id, position, notes, selected_at)
+    values (?, ?, ?, ?, ?, ?, ?)
+  `);
+  nextIds.forEach((assetId, position) => {
+    const existing = current.find((row) => row.asset_id === assetId);
+    const notes = inputAssetIds.includes(assetId) ? fields.notes || existing?.notes : existing?.notes;
+    insert.run(selectionId(project, root, assetId), project, root, assetId, position, notes || null, timestamp);
+  });
+  database.close();
+  const message = nextIds.length === 0 ? `Cleared selected assets for ${root}` : `Selected ${nextIds.length} asset${nextIds.length === 1 ? "" : "s"} for ${root}`;
+  return { ok: true, message, root_asset_id: root, asset_id: nextIds[0] || null, asset_ids: nextIds, mode };
+}
+function updateAssetReview(project, fields) {
+  const allowed = /* @__PURE__ */ new Set(["unreviewed", "approved", "needs_revision", "rejected", "ignored"]);
+  if (!allowed.has(fields.reviewState)) throw new LineageError(`Unsupported review state: ${fields.reviewState}`);
   const database = lineageDb();
-  try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, fields.claimToken);
-    if (!row) return denied("claim_token_invalid", "Unknown or invalid claim token.");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") return denied("claim_not_active", `Agent claim is ${claim.status}.`);
-    if (new Date(claim.expires_at).getTime() <= Date.now()) return denied("claim_expired", "Agent claim has expired.");
-    if (claim.project !== fields.project) return denied("claim_project_mismatch", `Claim project ${claim.project} does not match ${fields.project}.`, [claim]);
-    if (fields.channel && claim.channel && claim.channel !== fields.channel) {
-      return denied("claim_channel_mismatch", `Claim channel ${claim.channel} does not match ${fields.channel}.`, [claim]);
-    }
-    if (!scopeAllowsWrite(claim, fields.scopeType, fields.targetId, fields.writeKind)) {
-      return denied("claim_scope_mismatch", `Claim does not cover ${fields.scopeType} ${fields.targetId}.`, [claim]);
-    }
-    recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
-      danger_level: fields.dangerLevel,
-      target_id: fields.targetId,
-      write_kind: fields.writeKind
-    });
-    return { ok: true, claim, warnings: [] };
-  } finally {
+  requireAsset2(database, project, fields.assetId);
+  if (!fields.confirmWrite) {
     database.close();
+    return { ok: true, dryRun: true, asset_id: fields.assetId, review_state: fields.reviewState, notes: fields.notes };
   }
+  const timestamp = nowIso();
+  database.prepare(`
+    insert into asset_reviews (asset_id, review_state, reviewed_at, ignored_at, notes, updated_at)
+    values (?, ?, ?, ?, ?, ?)
+    on conflict(asset_id) do update set
+      review_state = excluded.review_state, reviewed_at = excluded.reviewed_at,
+      ignored_at = excluded.ignored_at, notes = excluded.notes, updated_at = excluded.updated_at
+  `).run(fields.assetId, fields.reviewState, timestamp, fields.reviewState === "ignored" ? timestamp : null, fields.notes || null, timestamp);
+  database.close();
+  return { ok: true, message: `Marked ${fields.assetId} ${fields.reviewState}`, asset_id: fields.assetId, review_state: fields.reviewState };
 }
 
 // src/server/assetLineageHandoff.ts
@@ -2396,14 +2493,15 @@ function linkSelectedLineageChild(project, fields) {
   const next = getLineageNextAsset(project, fields.rootAssetId);
   if (!next.next_asset) throw new LineageError("Cannot link child until a next base is selected or unambiguous");
   if (fields.confirmWrite) {
+    const claimContext = getLineageWriteClaimContext(project, next.next_asset.asset_id);
     const validation = validateAgentClaimForWrite({
-      channel: next.next_asset.channel,
+      channel: claimContext.channel,
       claimToken: fields.claimToken,
       confirmWrite: fields.confirmWrite,
       dangerLevel: "enforce",
       project,
       scopeType: "lineage_workspace",
-      targetId: lineageWorkspaceId(project, next.root_asset_id),
+      targetId: lineageWorkspaceId(project, claimContext.rootAssetId),
       writeKind: "link_child"
     });
     if (!validation.ok) throw new AgentClaimError(validation.message, validation.code === "claim_required" ? 401 : 403, validation.code, validation.conflicts);
@@ -2429,6 +2527,10 @@ function requireAsset3(database, project, assetId) {
   const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
   if (!row) throw new LineageError(`Unknown indexed asset: ${assetId}`, 404);
 }
+function assetChannel2(database, project, assetId) {
+  const row = database.prepare("select channel from assets where project_id = ? and id = ?").get(project, assetId);
+  return row?.channel;
+}
 function parentOf2(database, project, assetId) {
   const row = database.prepare("select parent_asset_id from asset_edges where project_id = ? and child_asset_id = ? order by created_at limit 1").get(project, assetId);
   return row?.parent_asset_id;
@@ -2475,6 +2577,19 @@ function removeLineageNode(project, fields) {
     database.close();
     throw new LineageError(`Asset ${fields.assetId} is not in lineage rooted at ${root}`, 404);
   }
+  try {
+    requireLineageWorkspaceClaimForWrite({
+      channel: assetChannel2(database, project, root),
+      claimToken: fields.claimToken,
+      confirmWrite: fields.confirmWrite,
+      project,
+      rootAssetId: root,
+      writeKind: "lineage_remove_node"
+    });
+  } catch (error) {
+    database.close();
+    throw error;
+  }
   const parentEdges = snapshot.edges.filter((edge) => edge.child_asset_id === fields.assetId);
   const childEdges = snapshot.edges.filter((edge) => edge.parent_asset_id === fields.assetId);
   const removedIds = [...parentEdges, ...childEdges].map((edge) => edge.id);
@@ -4215,7 +4330,7 @@ function updateContentPost(project, fields) {
   const timestamp = nowIso();
   try {
     const current = findContentPost(database, project, postId);
-    if (fields.phase) requireContentPostClaim(project, current, fields.claimToken, "content_post_phase");
+    requireContentPostClaim(project, current, fields.claimToken, fields.phase ? "content_post_phase" : "content_post_update");
     if (fields.batchId) {
       const batch = database.prepare("select id from content_batches where project_id = ? and id = ?").get(project, fields.batchId);
       if (!batch) throw new ContentBatchError(`Unknown content batch: ${fields.batchId}`, 404);
@@ -4389,7 +4504,8 @@ function setContentTarget(project, fields) {
   const database = lineageDb();
   const timestamp = nowIso();
   try {
-    findPost(database, project, postId);
+    const post = findPost(database, project, postId);
+    requireContentPostClaim(project, post, fields.claimToken, "content_target_set");
     database.prepare(`
       insert into content_targets (project_id, post_id, notes, selected_at, updated_at)
       values (?, ?, ?, ?, ?)
@@ -4402,10 +4518,19 @@ function setContentTarget(project, fields) {
   }
   return { ok: true, message: `Selected content target ${postId}`, ...getContentTarget(project) };
 }
-function clearContentTarget(project, confirmWrite) {
+function clearContentTarget(project, confirmWrite, claimToken) {
   if (!confirmWrite) return { ok: true, dryRun: true, message: "Would clear selected content target" };
   const database = lineageDb();
   try {
+    const row = database.prepare("select post_id from content_targets where project_id = ?").get(project);
+    if (row?.post_id) {
+      try {
+        const post = findPost(database, project, String(row.post_id));
+        requireContentPostClaim(project, post, claimToken, "content_target_clear");
+      } catch (error) {
+        if (!(error instanceof ContentBatchError && error.status === 404)) throw error;
+      }
+    }
     database.prepare("delete from content_targets where project_id = ?").run(project);
   } finally {
     database.close();
@@ -4873,13 +4998,14 @@ function contentBatchRouter(projectFrom2) {
   });
   router.post("/target", (req, res) => {
     res.json(setContentTarget(projectFrom2(bodyProjectShape(req)), {
+      claimToken: claimTokenFromRequest2(req),
       confirmWrite: boolBody2(req, "confirmWrite"),
       notes: stringBody2(req, "notes"),
       postId: stringBody2(req, "postId") || ""
     }));
   });
   router.post("/target/clear", (req, res) => {
-    res.json(clearContentTarget(projectFrom2(bodyProjectShape(req)), boolBody2(req, "confirmWrite")));
+    res.json(clearContentTarget(projectFrom2(bodyProjectShape(req)), boolBody2(req, "confirmWrite"), claimTokenFromRequest2(req)));
   });
   router.get("/batches/:batchId", (req, res) => {
     res.json(getContentBatch(projectFrom2(req), req.params.batchId));
@@ -5815,13 +5941,14 @@ app.post(
       linkLineageAssets(projectFrom(req), {
         parentAssetId: String(req.body.parentAssetId || ""),
         childAssetId: String(req.body.childAssetId || ""),
-        confirmWrite: req.body.confirmWrite === true
+        confirmWrite: req.body.confirmWrite === true,
+        claimToken: claimTokenFromRequest(req)
       })
     );
   })
 );
 app.post("/api/lineage/remove-node", asyncRoute((req, res) => {
-  res.json(removeLineageNode(projectFrom(req), { assetId: String(req.body.assetId || ""), rootAssetId: typeof req.body.rootAssetId === "string" ? req.body.rootAssetId : void 0, confirmWrite: req.body.confirmWrite === true }));
+  res.json(removeLineageNode(projectFrom(req), { assetId: String(req.body.assetId || ""), rootAssetId: typeof req.body.rootAssetId === "string" ? req.body.rootAssetId : void 0, confirmWrite: req.body.confirmWrite === true, claimToken: claimTokenFromRequest(req) }));
 }));
 app.post(
   "/api/lineage/layout",
@@ -5835,7 +5962,8 @@ app.post(
           x: Number(position.x),
           y: Number(position.y)
         })),
-        confirmWrite: req.body.confirmWrite === true
+        confirmWrite: req.body.confirmWrite === true,
+        claimToken: claimTokenFromRequest(req)
       })
     );
   })