akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/commands/sources/installed-stashes.js

@@ -13,26 +13,71 @@
  * a lock entry is "managed" (installed from a registry and overwritten on
  * `akm bundle update`); a bundle with no lock is a plain filesystem/git/website source.
  */
+import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { isWithin, resolveStashDir } from "../../core/common.js";
-import { getSources, loadConfig } from "../../core/config/config.js";
-import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
+import { acquireConfigReadFence, bundleComponentConfig, getSources, loadConfig } from "../../core/config/config.js";
+import { AkmError, ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { isPathAbsent } from "../../core/path-access.js";
-import { getDbPath } from "../../core/paths.js";
+import { getDbPath, getRegistryCacheDir } from "../../core/paths.js";
+import { beginImmediateTransaction, getStateDbPath, openStateDatabase } from "../../core/state-db.js";
 import { warn } from "../../core/warn.js";
+import { resolveGitContentRoot } from "../../core/write-source.js";
 import { withAssetMutationLease } from "../../indexer/index-writer-lock.js";
 import { akmIndex } from "../../indexer/indexer.js";
-import { compareAndSwapLockfile, readLockfile } from "../../integrations/lockfile.js";
+import { compareAndSwapLockfileSnapshot, publishLockfileUpdate, readLockfile, readLockfileForUpdate, } from "../../integrations/lockfile.js";
 import { parseRegistryRef } from "../../registry/resolve.js";
 import { sha256Hex } from "../../runtime.js";
-import { parseGitRepoUrl, syncMirroredRepo } from "../../sources/providers/git.js";
+import { getCachePaths, parseGitRepoUrl, runGit, syncMirroredRepo } from "../../sources/providers/git.js";
 import { syncFromRef } from "../../sources/providers/sync-from-ref.js";
-import { ensureWebsiteMirror, shouldAllowPrivateWebsiteUrlForTests, } from "../../sources/snapshot-fetchers/website-ingest.js";
-import { closeDatabase, openReadonlyExistingDatabase } from "../../storage/repositories/index-connection.js";
+import { createWebsiteProvider } from "../../sources/providers/website.js";
+import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
+import { ensureWebsiteMirror } from "../../sources/snapshot-fetchers/website-ingest.js";
+import { getWebsiteCachePaths } from "../../sources/website-url.js";
+import { closeDatabase, openIndexDatabase, openReadonlyExistingDatabase, } from "../../storage/repositories/index-connection.js";
 import { getAllEntries } from "../../storage/repositories/index-entries-repository.js";
+import { auditStashForDangerousKeys, scanStashForDangerousKeys } from "./dangerous-env-audit.js";
 import { removeInstalledRegistryEntry } from "./source-add.js";
 import { removeStash } from "./source-manage.js";
+import { cleanupStagingParent, createStagingParent, prepareDirectoryPublication, prepareWritableGitPublication, } from "./update-transaction.js";
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right));
+        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function bundleAuditGeneration(entry) {
+    return sha256Hex(canonicalJson(entry ?? null));
+}
+function bundleAuditFence(config, id) {
+    const bundle = config.bundles?.[id];
+    if (!bundle)
+        throw new ConfigError(`Source "${id}" disappeared before update staging.`);
+    return {
+        componentRoot: bundleComponentConfig(bundle)?.root ?? ".",
+        generation: bundleAuditGeneration(bundle),
+        writable: bundleComponentConfig(bundle)?.writable ?? bundle.writable === true,
+    };
+}
+function assertBundleAuditFence(config, id, expectedGeneration) {
+    const current = config.bundles?.[id];
+    if (bundleAuditGeneration(current) !== expectedGeneration) {
+        throw new ConfigError(`Source "${id}" config changed after its staged bytes were audited; refusing to publish without re-staging and re-auditing.`);
+    }
+}
+function currentPlainSource(config, id, type) {
+    const source = getSources(config).find((candidate) => candidate.name === id && candidate.type === type);
+    if (!source) {
+        throw new ConfigError(`Source "${id}" changed or disappeared before update staging; retry to re-resolve it.`);
+    }
+    return source;
+}
 /** Enumerate the registry-managed installs (lock-backed bundles) in a config. */
 function listManagedInstalls(config) {
     const bundles = config.bundles ?? {};
@@ -43,6 +88,7 @@ function listManagedInstalls(config) {
         if (!lock)
             continue; // only lock-backed bundles are registry-managed
         const componentWritable = Object.values(bundle.components ?? {})[0]?.writable;
+        const componentRoot = bundleComponentConfig(bundle)?.root ?? ".";
         out.push({
             bundleKey: key,
             installId: bundle.registryId ?? key,
@@ -52,9 +98,9 @@ function listManagedInstalls(config) {
             resolvedVersion: lock.resolvedVersion,
             resolvedRevision: lock.resolvedRevision,
             writable: componentWritable ?? bundle.writable === true,
-            requiredRoots: lock.localRoot
-                ? Object.values(bundle.components ?? {}).map((component) => path.resolve(lock.localRoot, component.root ?? "."))
-                : [],
+            componentRoot,
+            requiredRoots: lock.localRoot ? [path.resolve(lock.localRoot, componentRoot)] : [],
+            auditConfigGeneration: bundleAuditGeneration(bundle),
         });
     }
     return out;
@@ -272,10 +318,26 @@ export async function akmRemove(input) {
         },
     };
 }
-// ── akmUpdate helpers ────────────────────────────────────────────────────────
-/** Build a standard UpdateResponse summary block from the current config and index run. */
-async function buildUpdateResponse(stashDir, target, all, processed, opts) {
-    const index = opts?.index ?? (await akmIndex({ stashDir, ...(opts?.full ? { full: true } : {}) }));
+/** Read the current index generation without creating or hydrating anything. */
+function readCurrentIndexSummary() {
+    const db = openReadonlyExistingDatabase(getDbPath());
+    if (!db)
+        return { mode: "incremental", totalEntries: 0, directoriesScanned: 0, directoriesSkipped: 0 };
+    try {
+        return {
+            mode: "incremental",
+            totalEntries: getAllEntries(db).length,
+            directoriesScanned: 0,
+            directoriesSkipped: 0,
+        };
+    }
+    finally {
+        closeDatabase(db);
+    }
+}
+/** Build a standard UpdateResponse summary block from a committed or unchanged index generation. */
+function buildUpdateResponse(stashDir, target, all, processed, opts) {
+    const index = opts.index;
     const finalConfig = loadConfig();
     return {
         schemaVersion: 1,
@@ -293,37 +355,569 @@ async function buildUpdateResponse(stashDir, target, all, processed, opts) {
             totalEntries: index.totalEntries,
             directoriesScanned: index.directoriesScanned,
             directoriesSkipped: index.directoriesSkipped,
+            ...(index.scanComplete !== undefined ? { scanComplete: index.scanComplete } : {}),
         },
     };
 }
-/**
- * Sync a git-mirrored (plain) source in place. Returns the {@link UpdatePlainSyncedItem}
- * record instead of building the full response, so `--all` can batch several of
- * these into one response alongside managed installs (R-015).
- */
-async function syncGitPlainSource(gitSource) {
-    await syncMirroredRepo(gitSource, { force: true, writable: gitSource.writable === true });
-    return { id: gitSource.name ?? gitSource.url ?? "", kind: "git", ref: gitSource.url ?? "" };
-}
-/** Re-crawl a website (plain) source in place. See {@link syncGitPlainSource}. */
-async function syncWebsitePlainSource(websiteSource) {
-    // TODO: full incremental re-crawl with delta tracking (#19)
-    await ensureWebsiteMirror(websiteSource, {
-        requireStashDir: true,
-        force: true,
-        ...(shouldAllowPrivateWebsiteUrlForTests(websiteSource.url ?? "") ? { allowPrivateHosts: true } : {}),
+function incompleteFilesystemOutcome(id) {
+    return {
+        id,
+        kind: "filesystem",
+        status: "skipped",
+        code: "SOURCE_SCAN_INCOMPLETE",
+        reason: `Filesystem source "${id}" was not scanned completely; preserving its last-known-good index rows.`,
+    };
+}
+let updateTransactionHookForTests;
+/** TEST-ONLY. Inject faults at source-update transaction boundaries. */
+export function _setUpdateTransactionHookForTests(hook) {
+    updateTransactionHookForTests = hook;
+}
+function updateTransactionHook(point, id, context) {
+    updateTransactionHookForTests?.(point, id, context);
+}
+function gitHead(repoDir) {
+    const result = runGit(["-C", repoDir, "rev-parse", "HEAD"]);
+    return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : undefined;
+}
+function invalidWritableGitPublication(repoDir) {
+    return {
+        publish() {
+            throw new ConfigError(`Writable Git source at ${repoDir} is not a valid checkout; refusing to replace its live directory.`);
+        },
+        rollback() { },
+        commit() { },
+    };
+}
+function writableGitPublication(opts) {
+    const auditedTargetHead = opts.auditedTargetHead ?? gitHead(opts.stagedRepo);
+    if (!opts.expectedOldHead || !auditedTargetHead)
+        return invalidWritableGitPublication(opts.liveRepo);
+    return prepareWritableGitPublication({
+        stagedRepo: opts.stagedRepo,
+        liveRepo: opts.liveRepo,
+        expectedOldHead: opts.expectedOldHead,
+        auditedTargetHead,
+    });
+}
+const UPDATE_STATE_SCHEMA = "akm_update_state";
+function sqliteStringLiteral(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function openUnifiedUpdateTransaction() {
+    // Keep canonical state activity registered for the entire attached
+    // transaction so maintenance/migration cannot replace state.db underneath
+    // the borrowed index connection.
+    const stateActivity = openStateDatabase();
+    try {
+        const statePath = getStateDbPath();
+        const db = openIndexDatabase(undefined, {
+            beforeSchema: (candidate) => {
+                candidate.exec(`ATTACH DATABASE ${sqliteStringLiteral(statePath)} AS "${UPDATE_STATE_SCHEMA}"`);
+                // openIndexDatabase invokes this before ensureSchema, so the outer
+                // transaction begins before the first update-owned index mutation.
+                beginImmediateTransaction(candidate);
+            },
+        });
+        return {
+            db,
+            stateActivity,
+            deferred: { db, stateSchema: UPDATE_STATE_SCHEMA },
+        };
+    }
+    catch (error) {
+        stateActivity.close();
+        throw error;
+    }
+}
+function rollbackUnifiedUpdateTransaction(transaction) {
+    if (!transaction.db.inTransaction)
+        return undefined;
+    try {
+        transaction.db.exec("ROLLBACK");
+        return undefined;
+    }
+    catch (error) {
+        return error;
+    }
+}
+function commitUnifiedUpdateTransaction(transaction) {
+    if (!transaction.db.inTransaction) {
+        throw new Error("Source update index returned without its active unified index/state transaction.");
+    }
+    transaction.db.exec("COMMIT");
+}
+function closeUnifiedUpdateTransaction(transaction, committed) {
+    let closeError = rollbackUnifiedUpdateTransaction(transaction);
+    try {
+        transaction.db.close();
+    }
+    catch (error) {
+        closeError ??= error;
+    }
+    try {
+        transaction.stateActivity.close();
+    }
+    catch (error) {
+        closeError ??= error;
+    }
+    if (closeError) {
+        warn(committed
+            ? `[akm bundle update] committed, but closing its database handles failed: ${String(closeError)}`
+            : `[akm bundle update] rolled back, but closing its database handles failed: ${String(closeError)}`);
+    }
+}
+function pathAtOrBelow(candidate, root) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function remapStagedPath(candidate, stagedRoot, liveRoot) {
+    if (!pathAtOrBelow(candidate, stagedRoot))
+        return candidate;
+    return path.join(liveRoot, path.relative(stagedRoot, candidate));
+}
+function dangerousFindingGeneration(findings) {
+    return JSON.stringify(findings
+        .map(({ envRef, keyName, relPath }) => ({ envRef, keyName, relPath }))
+        .sort((left, right) => `${left.relPath}\0${left.envRef}\0${left.keyName}`.localeCompare(`${right.relPath}\0${right.envRef}\0${right.keyName}`)));
+}
+async function contentGeneration(root) {
+    const hash = createHash("sha256");
+    const resolvedRoot = path.resolve(root);
+    const walk = async (directory) => {
+        const entries = fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (entry.name === ".git")
+                continue;
+            const absolute = path.join(directory, entry.name);
+            const relative = path.relative(resolvedRoot, absolute).replaceAll(path.sep, "/");
+            const before = fs.lstatSync(absolute);
+            if (before.isDirectory()) {
+                hash.update(`D\0${relative}\0${before.mode & 0o777}\0`);
+                await walk(absolute);
+            }
+            else if (before.isSymbolicLink()) {
+                hash.update(`L\0${relative}\0${fs.readlinkSync(absolute)}\0`);
+            }
+            else if (before.isFile()) {
+                hash.update(`F\0${relative}\0${before.mode & 0o777}\0${before.size}\0`);
+                for await (const chunk of fs.createReadStream(absolute))
+                    hash.update(chunk);
+                const after = fs.lstatSync(absolute);
+                if (after.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs) {
+                    throw new ConfigError(`Source content changed while ${relative} was being audited; retry the update.`);
+                }
+                hash.update("\0");
+            }
+            else {
+                throw new ConfigError(`Unsupported filesystem entry ${absolute}; refusing to audit an unstable source tree.`);
+            }
+        }
+    };
+    if (!fs.statSync(resolvedRoot).isDirectory())
+        throw new ConfigError(`Expected ${resolvedRoot} to be a directory.`);
+    await walk(resolvedRoot);
+    return hash.digest("hex");
+}
+async function verifyPublishedAudit(prepared, id) {
+    const liveRoot = prepared.publishedAuditRoot;
+    if (!liveRoot)
+        return;
+    const resolveLiveAuditRoot = () => {
+        const physicalRoot = canonicalWritablePath(liveRoot, `published component root for "${id}"`);
+        const containmentRoot = prepared.publishedAuditContainmentRoot;
+        if (containmentRoot && !pathAtOrBelow(physicalRoot, containmentRoot)) {
+            throw new ConfigError(`Published component root ${liveRoot} resolves outside its physical checkout at ${containmentRoot}.`, "DANGEROUS_ENV_AUDIT_FAILED");
+        }
+        const expected = prepared.publishedAuditExpectedPhysicalRoot;
+        if (expected && path.resolve(physicalRoot) !== path.resolve(expected)) {
+            throw new ConfigError(`Published component root ${liveRoot} resolves to ${physicalRoot}, not its audited staged target ${expected}.`, "DANGEROUS_ENV_AUDIT_FAILED");
+        }
+        return physicalRoot;
+    };
+    const beforeRoot = resolveLiveAuditRoot();
+    const beforeAudit = await contentGeneration(beforeRoot);
+    let findings;
+    try {
+        const scanRoot = resolveLiveAuditRoot();
+        if (scanRoot !== beforeRoot)
+            throw new Error("configured component symlink changed during re-audit");
+        findings = scanStashForDangerousKeys(scanRoot);
+    }
+    catch (error) {
+        throw new ConfigError(`Dangerous environment-key re-audit failed after materializing "${id}"; rolling the update back. ${error instanceof Error ? error.message : String(error)}`, "DANGEROUS_ENV_AUDIT_FAILED");
+    }
+    const afterRoot = resolveLiveAuditRoot();
+    const afterAudit = await contentGeneration(afterRoot);
+    if (afterRoot !== beforeRoot ||
+        beforeAudit !== prepared.auditedContentGeneration ||
+        afterAudit !== prepared.auditedContentGeneration ||
+        dangerousFindingGeneration(findings) !== prepared.approvedDangerousFindings) {
+        throw new ConfigError(`Writable source "${id}" changed while its audited Git target was materialized; refusing to activate unaudited bytes.`, "DANGEROUS_ENV_AUDIT_FAILED");
+    }
+}
+async function auditPreparedUpdate(prepared, id, ref, allowInsecure) {
+    updateTransactionHook("staged", id);
+    const decision = await auditStashForDangerousKeys({
+        stashRoot: prepared.auditRoot,
+        ref,
+        allowDangerousKeys: allowInsecure,
+        isTTY: process.stdin.isTTY === true,
+        operation: "update",
+        renderBlockedError: false,
     });
-    return { id: websiteSource.name ?? websiteSource.url ?? "", kind: "website", ref: websiteSource.url ?? "" };
+    if (decision.blocked)
+        throw new NotFoundError(decision.error, decision.code);
+    prepared.approvedDangerousFindings = dangerousFindingGeneration(decision.findings);
+    prepared.auditedContentGeneration = await contentGeneration(prepared.auditRoot);
+    updateTransactionHook("audited", id);
+}
+function canonicalWritablePath(candidate, description) {
+    try {
+        return fs.realpathSync(candidate);
+    }
+    catch (error) {
+        throw new ConfigError(`Cannot resolve ${description} at ${candidate}; refusing writable Git update. ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function containedWritablePath(candidate, physicalRepo, description) {
+    const physicalCandidate = canonicalWritablePath(candidate, description);
+    if (!pathAtOrBelow(physicalCandidate, physicalRepo)) {
+        throw new ConfigError(`${description} ${candidate} resolves outside its physical checkout at ${physicalRepo}.`);
+    }
+    return physicalCandidate;
+}
+function prepareWritableManagedUpdate(managed, force) {
+    const physicalLocalRoot = canonicalWritablePath(managed.localRoot, "managed content root");
+    const topLevel = runGit(["-C", physicalLocalRoot, "rev-parse", "--show-toplevel"]);
+    // Production writable installs are Git checkouts. Falling back to the
+    // locked root keeps the provider seam testable; the real Git provider still
+    // refuses a copied non-checkout before publication.
+    const liveRepo = topLevel.status === 0 && topLevel.stdout.trim()
+        ? canonicalWritablePath(topLevel.stdout.trim(), "managed Git top-level")
+        : physicalLocalRoot;
+    if (!pathAtOrBelow(physicalLocalRoot, liveRepo)) {
+        throw new ConfigError(`Writable Git content root ${managed.localRoot} resolves outside its physical checkout at ${liveRepo}.`);
+    }
+    // Keep the configured component path as a lexical identity relative to the
+    // content root. Resolving it to today's symlink target here would pin the old
+    // target and miss an upstream commit that retargets the symlink.
+    const lexicalLocalRoot = path.resolve(managed.localRoot);
+    const configuredLiveRoots = managed.requiredRoots.map((root) => {
+        const lexicalRoot = path.resolve(root);
+        if (!pathAtOrBelow(lexicalRoot, lexicalLocalRoot)) {
+            throw new ConfigError(`Configured writable Git component root ${lexicalRoot} escapes content root ${lexicalLocalRoot}.`);
+        }
+        return path.resolve(physicalLocalRoot, path.relative(lexicalLocalRoot, lexicalRoot));
+    });
+    const physicalRequiredRoots = configuredLiveRoots.map((root) => containedWritablePath(root, liveRepo, `Configured component root for "${managed.installId}"`));
+    // The Git provider must preserve ordinary component directories, but not a
+    // symlink's current physical target. The configured lexical path is audited
+    // again after sync, so retaining the old target here would reject a valid
+    // upstream retarget before the new target can reach that audit.
+    const preservedPhysicalRequiredRoots = physicalRequiredRoots.filter((root, index) => configuredLiveRoots[index] === root);
+    const expectedOldHead = gitHead(liveRepo);
+    const stagingParent = createStagingParent(path.dirname(liveRepo));
+    const stagedRepo = path.join(stagingParent, path.basename(liveRepo));
+    fs.cpSync(liveRepo, stagedRepo, { recursive: true, preserveTimestamps: true, verbatimSymlinks: true });
+    const stagedContentRoot = remapStagedPath(physicalLocalRoot, liveRepo, stagedRepo);
+    const stagedPhysicalRequiredRoots = preservedPhysicalRequiredRoots.map((root) => remapStagedPath(root, liveRepo, stagedRepo));
+    const stagedConfiguredRoots = configuredLiveRoots.map((root) => remapStagedPath(root, liveRepo, stagedRepo));
+    return syncFromRef(managed.ref, {
+        force,
+        writable: true,
+        writableRoot: stagedContentRoot,
+        ...(stagedPhysicalRequiredRoots.length > 0 ? { writableRequiredRoots: stagedPhysicalRequiredRoots } : {}),
+    })
+        .then((staged) => {
+        const auditedTargetHead = gitHead(stagedRepo);
+        const physicalStagedRepo = canonicalWritablePath(stagedRepo, "staged managed Git checkout");
+        const auditedConfiguredRoots = stagedConfiguredRoots.map((root) => containedWritablePath(root, physicalStagedRepo, `Post-sync component root for "${managed.installId}"`));
+        const expectedPublishedRoots = auditedConfiguredRoots.map((root) => path.join(liveRepo, path.relative(physicalStagedRepo, root)));
+        const synced = {
+            ...staged,
+            resolvedRevision: auditedTargetHead ?? staged.resolvedRevision,
+            contentDir: remapStagedPath(staged.contentDir, stagedRepo, liveRepo),
+            cacheDir: remapStagedPath(staged.cacheDir, stagedRepo, liveRepo),
+            extractedDir: remapStagedPath(staged.extractedDir, stagedRepo, liveRepo),
+        };
+        return {
+            synced,
+            auditRoot: auditedConfiguredRoots[0] ?? staged.contentDir,
+            publishedAuditRoot: configuredLiveRoots[0] ?? synced.contentDir,
+            publishedAuditContainmentRoot: liveRepo,
+            publishedAuditExpectedPhysicalRoot: expectedPublishedRoots[0] ?? synced.contentDir,
+            publication: writableGitPublication({ stagedRepo, liveRepo, expectedOldHead, auditedTargetHead }),
+            cleanup: () => cleanupStagingParent(stagingParent),
+        };
+    })
+        .catch((error) => {
+        cleanupStagingParent(stagingParent);
+        throw error;
+    });
+}
+async function prepareManagedUpdate(managed, force) {
+    if (managed.writable && managed.localRoot)
+        return prepareWritableManagedUpdate(managed, force);
+    if (managed.source === "local") {
+        const synced = await syncFromRef(managed.ref, { force, writable: managed.writable });
+        return {
+            synced,
+            auditRoot: resolveComponentAuditRoot(synced.contentDir, managed.componentRoot, managed.installId),
+            cleanup: () => { },
+        };
+    }
+    const canonicalCacheRoot = getRegistryCacheDir();
+    const stagingParent = createStagingParent(canonicalCacheRoot);
+    try {
+        const staged = await syncFromRef(managed.ref, {
+            force,
+            writable: false,
+            cacheRootDir: stagingParent,
+        });
+        if (!pathAtOrBelow(staged.cacheDir, stagingParent)) {
+            // Test/provider seams may return an already-isolated candidate. It remains
+            // invisible until the lock points at it, so no directory promotion is needed.
+            return {
+                synced: staged,
+                auditRoot: resolveComponentAuditRoot(staged.contentDir, managed.componentRoot, managed.installId),
+                cleanup: () => cleanupStagingParent(stagingParent),
+            };
+        }
+        const liveCacheDir = path.join(canonicalCacheRoot, path.relative(stagingParent, staged.cacheDir));
+        const synced = {
+            ...staged,
+            contentDir: remapStagedPath(staged.contentDir, staged.cacheDir, liveCacheDir),
+            cacheDir: liveCacheDir,
+            extractedDir: remapStagedPath(staged.extractedDir, staged.cacheDir, liveCacheDir),
+        };
+        return {
+            synced,
+            auditRoot: resolveComponentAuditRoot(staged.contentDir, managed.componentRoot, managed.installId),
+            publication: prepareDirectoryPublication(staged.cacheDir, liveCacheDir),
+            cleanup: () => cleanupStagingParent(stagingParent),
+        };
+    }
+    catch (error) {
+        cleanupStagingParent(stagingParent);
+        throw error;
+    }
+}
+function resolveComponentAuditRoot(contentRoot, componentRoot, id) {
+    const resolved = path.resolve(contentRoot, componentRoot);
+    if (!pathAtOrBelow(resolved, contentRoot)) {
+        throw new ConfigError(`Component root "${componentRoot}" escapes staged bundle "${id}".`);
+    }
+    return resolved;
+}
+async function publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, full, expectedConfigGeneration) {
+    try {
+        await auditPreparedUpdate(prepared, id, ref, allowInsecure);
+        return await withAssetMutationLease("source-update", async () => {
+            let transaction;
+            let releaseConfigFence;
+            let contentPublished = false;
+            let committed = false;
+            try {
+                const configFence = acquireConfigReadFence();
+                releaseConfigFence = configFence.release;
+                assertBundleAuditFence(configFence.config, id, expectedConfigGeneration);
+                updateTransactionHook("fenced", id);
+                if (prepared.publication) {
+                    prepared.publication.publish();
+                    contentPublished = true;
+                }
+                await verifyPublishedAudit(prepared, id);
+                updateTransactionHook("published", id);
+                updateTransactionHook("before-index", id);
+                transaction = openUnifiedUpdateTransaction();
+                const index = await akmIndex({
+                    stashDir,
+                    ...(full ? { full: true } : {}),
+                    hydrateSources: false,
+                    persistDetectedAdapters: false,
+                    deferredUpdateTransaction: transaction.deferred,
+                });
+                updateTransactionHook("indexed", id, { db: transaction.db });
+                // Re-fence the exact published worktree after the potentially long
+                // index pass and immediately before the coordinator commit. This
+                // catches cooperating or observable external writes that land after
+                // the first post-materialization audit.
+                await verifyPublishedAudit(prepared, id);
+                updateTransactionHook("before-commit", id, { db: transaction.db });
+                commitUnifiedUpdateTransaction(transaction);
+                committed = true;
+                try {
+                    transaction.deferred.afterCommit?.();
+                }
+                catch (error) {
+                    warn(`[akm bundle update] committed, but semantic status refresh failed: ${String(error)}`);
+                }
+                prepared.publication?.commit();
+                return index;
+            }
+            catch (error) {
+                let recoveryError = transaction ? rollbackUnifiedUpdateTransaction(transaction) : undefined;
+                try {
+                    if (contentPublished)
+                        prepared.publication?.rollback();
+                }
+                catch (rollbackError) {
+                    recoveryError ??= rollbackError;
+                }
+                if (recoveryError)
+                    throw recoveryError;
+                throw error;
+            }
+            finally {
+                try {
+                    if (transaction)
+                        closeUnifiedUpdateTransaction(transaction, committed);
+                }
+                finally {
+                    releaseConfigFence?.();
+                }
+            }
+        });
+    }
+    finally {
+        prepared.cleanup();
+    }
+}
+async function prepareGitPlainUpdate(gitSource, componentRoot, writable) {
+    if (!gitSource.url)
+        throw new ConfigError(`Git source "${gitSource.name ?? "git"}" has no URL.`);
+    const repo = parseGitRepoUrl(gitSource.url);
+    const livePaths = getCachePaths(repo.canonicalUrl);
+    const stagingParent = createStagingParent(path.dirname(livePaths.rootDir));
+    const stagedPaths = getCachePaths(repo.canonicalUrl, stagingParent);
+    try {
+        const expectedOldHead = writable ? gitHead(livePaths.repoDir) : undefined;
+        if (writable && fs.existsSync(livePaths.rootDir)) {
+            fs.cpSync(livePaths.rootDir, stagedPaths.rootDir, { recursive: true, preserveTimestamps: true });
+        }
+        const staged = await syncMirroredRepo(gitSource, {
+            force: true,
+            writable,
+            cacheRootDir: stagingParent,
+        });
+        const configuredStagedAuditRoot = resolveComponentAuditRoot(resolveGitContentRoot(staged.contentDir), componentRoot, gitSource.name ?? "git");
+        if (!pathAtOrBelow(staged.cacheDir, stagingParent)) {
+            if (pathAtOrBelow(configuredStagedAuditRoot, livePaths.rootDir)) {
+                throw new ConfigError(`Git provider for "${gitSource.name ?? gitSource.url}" wrote into the active cache instead of the update staging root; refusing to index it.`);
+            }
+            // A provider test seam may hand back an already-isolated candidate.
+            // Audit it, but do not move an unowned directory into the canonical
+            // cache. Real providers honor cacheRootDir and use the promotion below.
+            return {
+                auditRoot: configuredStagedAuditRoot,
+                cleanup: () => cleanupStagingParent(stagingParent),
+            };
+        }
+        let auditRoot = configuredStagedAuditRoot;
+        let publishedAuditRoot;
+        let publishedAuditContainmentRoot;
+        let publishedAuditExpectedPhysicalRoot;
+        if (writable) {
+            const physicalStagedRepo = canonicalWritablePath(stagedPaths.repoDir, "staged plain Git checkout");
+            auditRoot = containedWritablePath(configuredStagedAuditRoot, physicalStagedRepo, `Post-sync component root for "${gitSource.name ?? "git"}"`);
+            publishedAuditRoot = remapStagedPath(configuredStagedAuditRoot, staged.cacheDir, livePaths.rootDir);
+            publishedAuditContainmentRoot = canonicalWritablePath(livePaths.repoDir, "plain Git checkout");
+            publishedAuditExpectedPhysicalRoot = path.join(publishedAuditContainmentRoot, path.relative(physicalStagedRepo, auditRoot));
+        }
+        return {
+            auditRoot,
+            ...(publishedAuditRoot ? { publishedAuditRoot } : {}),
+            ...(publishedAuditContainmentRoot ? { publishedAuditContainmentRoot } : {}),
+            ...(publishedAuditExpectedPhysicalRoot ? { publishedAuditExpectedPhysicalRoot } : {}),
+            publication: writable
+                ? writableGitPublication({
+                    stagedRepo: stagedPaths.repoDir,
+                    liveRepo: livePaths.repoDir,
+                    expectedOldHead,
+                })
+                : prepareDirectoryPublication(staged.cacheDir, livePaths.rootDir),
+            cleanup: () => cleanupStagingParent(stagingParent),
+        };
+    }
+    catch (error) {
+        cleanupStagingParent(stagingParent);
+        throw error;
+    }
+}
+async function syncGitPlainSource(gitSource, stashDir, allowInsecure) {
+    const id = gitSource.name ?? gitSource.url ?? "";
+    const currentConfig = loadConfig();
+    const currentSource = currentPlainSource(currentConfig, id, "git");
+    const ref = currentSource.url ?? "";
+    const fence = bundleAuditFence(currentConfig, id);
+    const prepared = await prepareGitPlainUpdate(currentSource, fence.componentRoot, fence.writable);
+    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, true, fence.generation);
+    return { item: { id, kind: "git", ref }, index };
+}
+async function prepareWebsitePlainUpdate(websiteSource, componentRoot) {
+    if (!websiteSource.url)
+        throw new ConfigError(`Website source "${websiteSource.name ?? "website"}" has no URL.`);
+    const livePaths = getWebsiteCachePaths(websiteSource.url);
+    const stagingParent = createStagingParent(path.dirname(livePaths.rootDir));
+    const stagedPaths = getWebsiteCachePaths(websiteSource.url, stagingParent);
+    try {
+        const provider = createWebsiteProvider(websiteSource);
+        await provider.sync({
+            force: true,
+            secrets: storeSecretResolver,
+            ensureWebsiteMirror: (config, options) => ensureWebsiteMirror(config, {
+                ...options,
+                resolveSecret: options?.resolveSecret ?? storeSecretResolver.resolveSecret,
+                cacheRootDir: stagingParent,
+            }),
+        });
+        return {
+            auditRoot: resolveComponentAuditRoot(stagedPaths.stashDir, componentRoot, websiteSource.name ?? "website"),
+            publication: prepareDirectoryPublication(stagedPaths.rootDir, livePaths.rootDir),
+            cleanup: () => cleanupStagingParent(stagingParent),
+        };
+    }
+    catch (error) {
+        cleanupStagingParent(stagingParent);
+        throw error;
+    }
+}
+async function syncWebsitePlainSource(websiteSource, stashDir, allowInsecure) {
+    const id = websiteSource.name ?? websiteSource.url ?? "";
+    const currentConfig = loadConfig();
+    const currentSource = currentPlainSource(currentConfig, id, "website");
+    const ref = currentSource.url ?? "";
+    const fence = bundleAuditFence(currentConfig, id);
+    const prepared = await prepareWebsitePlainUpdate(currentSource, fence.componentRoot);
+    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, true, fence.generation);
+    return { item: { id, kind: "website", ref }, index };
 }
 /** Sync a git-mirrored (plain) source and return an UpdateResponse (single-target path). */
-async function updateGitSource(stashDir, target, all, gitSource) {
-    const synced = await syncGitPlainSource(gitSource);
-    return buildUpdateResponse(stashDir, target, all, [], { full: true, plainSynced: [synced] });
+async function updateGitSource(stashDir, target, all, gitSource, allowInsecure) {
+    const synced = await syncGitPlainSource(gitSource, stashDir, allowInsecure);
+    return buildUpdateResponse(stashDir, target, all, [], { plainSynced: [synced.item], index: synced.index });
 }
 /** Re-crawl a website (plain) source and return an UpdateResponse (single-target path). */
-async function updateWebsiteSource(stashDir, target, all, websiteSource) {
-    const synced = await syncWebsitePlainSource(websiteSource);
-    return buildUpdateResponse(stashDir, target, all, [], { plainSynced: [synced] });
+async function updateWebsiteSource(stashDir, target, all, websiteSource, allowInsecure) {
+    const synced = await syncWebsitePlainSource(websiteSource, stashDir, allowInsecure);
+    return buildUpdateResponse(stashDir, target, all, [], { plainSynced: [synced.item], index: synced.index });
+}
+/** Reconcile a filesystem source's current bytes without provider hydration. */
+async function updateFilesystemSource(stashDir, target, all, filesystemSource) {
+    const id = filesystemSource.name ?? filesystemSource.path ?? target;
+    const ref = filesystemSource.path ?? target;
+    const index = await akmIndex({ stashDir, hydrateSources: false });
+    if (!index.scanComplete) {
+        return buildUpdateResponse(stashDir, target, all, [], {
+            skipped: [incompleteFilesystemOutcome(id)],
+            index,
+        });
+    }
+    return buildUpdateResponse(stashDir, target, all, [], {
+        plainSynced: [{ id, kind: "filesystem", ref }],
+        index,
+    });
 }
 /**
  * A plain (lockless) npm bundle has no deterministic content path — unlike
@@ -338,9 +932,12 @@ async function updateWebsiteSource(stashDir, target, all, websiteSource) {
  * bookkeeping.
  */
 function managedInstallViewOfPlainNpm(npmSource) {
-    const spec = npmSource.path ?? "";
+    const id = npmSource.name ?? npmSource.path ?? "";
+    const config = loadConfig();
+    const currentSource = currentPlainSource(config, id, "npm");
+    const spec = currentSource.path ?? "";
     const ref = spec.startsWith("npm:") ? spec : `npm:${spec}`;
-    const id = npmSource.name ?? ref;
+    const fence = bundleAuditFence(config, id);
     return {
         bundleKey: id,
         installId: id,
@@ -350,7 +947,9 @@ function managedInstallViewOfPlainNpm(npmSource) {
         resolvedVersion: undefined,
         resolvedRevision: undefined,
         writable: false,
+        componentRoot: fence.componentRoot,
         requiredRoots: [],
+        auditConfigGeneration: fence.generation,
     };
 }
 /**
@@ -364,101 +963,193 @@ function managedInstallViewOfPlainNpm(npmSource) {
  * scripts; only the branch that can `rm -rf` needs a gate, not the whole
  * command).
  */
-async function updateManagedInstall(managed, force, yes, stashDir) {
+async function updateManagedInstall(managed, force, yes, stashDir, allowInsecure) {
     // No pre-cleanup of the old root, even under --force: the providers already
     // re-materialize staging-first (git clones into a `.tmp-*` sibling and swaps
     // only on success), so destroying `managed.localRoot` BEFORE `syncFromRef`
     // succeeds would turn any sync failure (network down, bad ref) into losing a
     // previously-working install. The old root is cleaned up below only after
     // config/lock publication and reindexing both succeed.
-    const synced = await syncFromRef(managed.ref, {
-        force,
-        writable: managed.writable,
-        ...(managed.writable && managed.localRoot ? { writableRoot: managed.localRoot } : {}),
-        ...(managed.writable && managed.requiredRoots.length > 0 ? { writableRequiredRoots: managed.requiredRoots } : {}),
-    });
-    const installedEntry = {
-        id: managed.installId,
-        // Preserve the original source classification. syncFromRef() re-derives the
-        // source type from the ref scheme (e.g. "github:" → source: "github"), but
-        // an update should not reclassify an existing entry.
-        source: managed.source,
-        ref: synced.ref,
-        artifactUrl: synced.artifactUrl,
-        resolvedVersion: synced.resolvedVersion,
-        resolvedRevision: synced.resolvedRevision,
-        stashRoot: synced.contentDir,
-        cacheDir: synced.cacheDir,
-        installedAt: synced.syncedAt,
-        writable: synced.writable ?? managed.writable,
-    };
-    const movedRoot = managed.localRoot !== "" &&
-        path.resolve(managed.localRoot) !== path.resolve(synced.contentDir) &&
-        managed.source !== "local" &&
-        !managed.writable;
-    if (movedRoot) {
-        const { confirmDestructive } = await import("../../cli/confirm.js");
-        const confirmed = await confirmDestructive(`Update resolved a new content directory for "${managed.installId}" (${synced.contentDir}) and would delete the previous install directory at ${managed.localRoot}. This cannot be undone.`, { yes });
-        if (!confirmed)
-            throw new UsageError(`Update cancelled for "${managed.installId}"; no configuration was changed.`);
-    }
-    return withAssetMutationLease("source-update", async () => {
-        const config = loadConfig();
-        const oldLocks = readLockfile();
-        if (!config.bundles?.[managed.bundleKey]) {
-            throw new ConfigError(`Managed source "${managed.installId}" disappeared before update publication.`);
-        }
-        const desiredLock = {
-            id: managed.bundleKey,
-            // Preserve the STORED install kind: a `github:`-ref entry recorded as
-            // source "git" must not be reclassified by the sync flow's re-derivation.
+    const prepared = await prepareManagedUpdate(managed, force);
+    try {
+        await auditPreparedUpdate(prepared, managed.installId, managed.ref, allowInsecure);
+        const synced = prepared.synced;
+        const installedEntry = {
+            id: managed.installId,
+            // Preserve the original source classification. syncFromRef() re-derives the
+            // source type from the ref scheme (e.g. "github:" → source: "github"), but
+            // an update should not reclassify an existing entry.
             source: managed.source,
             ref: synced.ref,
+            artifactUrl: synced.artifactUrl,
             resolvedVersion: synced.resolvedVersion,
             resolvedRevision: synced.resolvedRevision,
-            integrity: synced.integrity ?? (synced.source === "local" ? "local" : undefined),
-            localRoot: synced.contentDir,
+            stashRoot: synced.contentDir,
+            cacheDir: synced.cacheDir,
             installedAt: synced.syncedAt,
+            writable: synced.writable ?? managed.writable,
         };
-        const desiredLocks = [...oldLocks.filter((entry) => entry.id !== desiredLock.id), desiredLock];
-        const desiredLockGeneration = generationHash(desiredLocks);
-        if (!(await compareAndSwapLockfile(oldLocks, desiredLocks)))
-            throw concurrentGenerationError(managed);
-        const index = await akmIndex({ stashDir });
-        if (generationHash(readLockfile()) !== desiredLockGeneration)
-            throw concurrentGenerationError(managed);
+        const movedRoot = managed.localRoot !== "" &&
+            path.resolve(managed.localRoot) !== path.resolve(synced.contentDir) &&
+            managed.source !== "local" &&
+            !managed.writable;
         if (movedRoot) {
-            const currentConfig = loadConfig();
-            const currentLocks = readLockfile();
-            if (referencesRoot(managed.localRoot, currentConfig, currentLocks)) {
-                warn(`[akm bundle update] kept previous install directory at ${managed.localRoot} because another configured or locked bundle still references it.`);
-            }
-            else {
-                cleanupDirectoryBestEffort(managed.localRoot, "update");
-            }
+            const { confirmDestructive } = await import("../../cli/confirm.js");
+            const confirmed = await confirmDestructive(`Update resolved a new content directory for "${managed.installId}" (${synced.contentDir}) and would delete the previous install directory at ${managed.localRoot}. This cannot be undone.`, { yes });
+            if (!confirmed)
+                throw new UsageError(`Update cancelled for "${managed.installId}"; no configuration was changed.`);
         }
-        const versionChanged = (managed.resolvedVersion ?? "") !== (synced.resolvedVersion ?? "");
-        const revisionChanged = (managed.resolvedRevision ?? "") !== (synced.resolvedRevision ?? "");
-        return {
-            index,
-            item: {
-                id: managed.installId,
+        return await withAssetMutationLease("source-update", async () => {
+            const oldLockSnapshot = readLockfileForUpdate();
+            const oldLocks = oldLockSnapshot.entries;
+            const desiredLock = {
+                id: managed.bundleKey,
+                // Preserve the STORED install kind: a `github:`-ref entry recorded as
+                // source "git" must not be reclassified by the sync flow's re-derivation.
                 source: managed.source,
-                ref: managed.ref,
-                previous: {
-                    resolvedVersion: managed.resolvedVersion,
-                    resolvedRevision: managed.resolvedRevision,
-                    cacheDir: managed.localRoot,
-                },
-                installed: { ...installedEntry, extractedDir: synced.extractedDir },
-                changed: {
-                    version: versionChanged,
-                    revision: revisionChanged,
-                    any: versionChanged || revisionChanged,
+                ref: synced.ref,
+                resolvedVersion: synced.resolvedVersion,
+                resolvedRevision: synced.resolvedRevision,
+                integrity: synced.integrity ?? (synced.source === "local" ? "local" : undefined),
+                localRoot: synced.contentDir,
+                installedAt: synced.syncedAt,
+            };
+            const desiredLocks = [...oldLocks.filter((entry) => entry.id !== desiredLock.id), desiredLock];
+            const desiredLockGeneration = generationHash(desiredLocks);
+            let transaction;
+            let releaseConfigFence;
+            let contentPublished = false;
+            let lockPublished = false;
+            let publishedLockSnapshot;
+            let committed = false;
+            let index;
+            try {
+                const configFence = acquireConfigReadFence();
+                releaseConfigFence = configFence.release;
+                assertBundleAuditFence(configFence.config, managed.bundleKey, managed.auditConfigGeneration);
+                updateTransactionHook("fenced", managed.installId);
+                if (prepared.publication) {
+                    prepared.publication.publish();
+                    contentPublished = true;
+                }
+                await verifyPublishedAudit(prepared, managed.installId);
+                publishedLockSnapshot = await publishLockfileUpdate(oldLockSnapshot, desiredLocks);
+                if (!publishedLockSnapshot)
+                    throw concurrentGenerationError(managed);
+                lockPublished = true;
+                updateTransactionHook("published", managed.installId);
+                updateTransactionHook("before-index", managed.installId);
+                transaction = openUnifiedUpdateTransaction();
+                index = await akmIndex({
+                    stashDir,
+                    full: true,
+                    hydrateSources: false,
+                    persistDetectedAdapters: false,
+                    deferredUpdateTransaction: transaction.deferred,
+                });
+                const currentLockSnapshot = readLockfileForUpdate();
+                if (generationHash(currentLockSnapshot.entries) !== desiredLockGeneration ||
+                    currentLockSnapshot.raw !== publishedLockSnapshot.raw ||
+                    currentLockSnapshot.mode !== publishedLockSnapshot.mode) {
+                    throw concurrentGenerationError(managed);
+                }
+                updateTransactionHook("indexed", managed.installId, { db: transaction.db });
+                // Indexing can be long enough for a local writer to race the first
+                // post-materialization audit. Re-verify the exact bytes/findings at the
+                // final cross-store commit boundary while every AKM fence is held.
+                await verifyPublishedAudit(prepared, managed.installId);
+                updateTransactionHook("before-commit", managed.installId, { db: transaction.db });
+                commitUnifiedUpdateTransaction(transaction);
+                committed = true;
+                try {
+                    transaction.deferred.afterCommit?.();
+                }
+                catch (error) {
+                    warn(`[akm bundle update] committed, but semantic status refresh failed: ${String(error)}`);
+                }
+            }
+            catch (error) {
+                let recoveryError = transaction ? rollbackUnifiedUpdateTransaction(transaction) : undefined;
+                let concurrentGeneration = false;
+                let concurrentGenerationOwnsPublishedRoot = false;
+                if (lockPublished) {
+                    try {
+                        if (!publishedLockSnapshot ||
+                            !(await compareAndSwapLockfileSnapshot(publishedLockSnapshot, oldLockSnapshot))) {
+                            concurrentGeneration = true;
+                            const concurrentLocks = readLockfileForUpdate().entries;
+                            const concurrentEntry = concurrentLocks.find((entry) => entry.id === desiredLock.id);
+                            concurrentGenerationOwnsPublishedRoot =
+                                prepared.publication !== undefined &&
+                                    concurrentEntry?.localRoot !== undefined &&
+                                    path.resolve(concurrentEntry.localRoot) === path.resolve(synced.contentDir);
+                        }
+                    }
+                    catch (compensationError) {
+                        recoveryError ??= compensationError;
+                    }
+                }
+                if (!concurrentGenerationOwnsPublishedRoot) {
+                    try {
+                        if (contentPublished)
+                            prepared.publication?.rollback();
+                    }
+                    catch (rollbackError) {
+                        recoveryError ??= rollbackError;
+                    }
+                }
+                if (recoveryError)
+                    throw recoveryError;
+                if (concurrentGeneration)
+                    throw concurrentGenerationError(managed);
+                throw error;
+            }
+            finally {
+                try {
+                    if (transaction)
+                        closeUnifiedUpdateTransaction(transaction, committed);
+                }
+                finally {
+                    releaseConfigFence?.();
+                }
+            }
+            prepared.publication?.commit();
+            if (movedRoot) {
+                const currentConfig = loadConfig();
+                const currentLocks = readLockfile();
+                if (referencesRoot(managed.localRoot, currentConfig, currentLocks)) {
+                    warn(`[akm bundle update] kept previous install directory at ${managed.localRoot} because another configured or locked bundle still references it.`);
+                }
+                else {
+                    cleanupDirectoryBestEffort(managed.localRoot, "update");
+                }
+            }
+            const versionChanged = (managed.resolvedVersion ?? "") !== (synced.resolvedVersion ?? "");
+            const revisionChanged = (managed.resolvedRevision ?? "") !== (synced.resolvedRevision ?? "");
+            return {
+                index,
+                item: {
+                    id: managed.installId,
+                    source: managed.source,
+                    ref: managed.ref,
+                    previous: {
+                        resolvedVersion: managed.resolvedVersion,
+                        resolvedRevision: managed.resolvedRevision,
+                        cacheDir: managed.localRoot,
+                    },
+                    installed: { ...installedEntry, extractedDir: synced.extractedDir },
+                    changed: {
+                        version: versionChanged,
+                        revision: revisionChanged,
+                        any: versionChanged || revisionChanged,
+                    },
                 },
-            },
-        };
-    });
+            };
+        });
+    }
+    finally {
+        prepared.cleanup();
+    }
 }
 function generationHash(value) {
     return sha256Hex(JSON.stringify(value));
@@ -494,13 +1185,14 @@ export async function akmUpdate(input) {
     const all = input?.all === true;
     const force = input?.force === true;
     const yes = input?.yes === true;
+    const allowInsecure = input?.allowInsecure === true;
     const config = loadConfig();
     const managedInstalls = listManagedInstalls(config);
     if (target && !all) {
         // Registry-managed install (lock-backed) — re-download from its locator.
         const managed = resolveManagedTarget(config, target);
         if (managed) {
-            const updated = await updateManagedInstall(managed, force, yes, stashDir);
+            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowInsecure);
             return buildUpdateResponse(stashDir, target, all, [updated.item], { index: updated.index });
         }
         // Plain git / website source (bundles without a lock) — provider re-sync.
@@ -529,7 +1221,7 @@ export async function akmUpdate(input) {
             return false;
         });
         if (gitMatch)
-            return updateGitSource(stashDir, target, all, gitMatch);
+            return updateGitSource(stashDir, target, all, gitMatch, allowInsecure);
         const websiteMatch = stashes.find((s) => {
             if (s.type !== "website")
                 return false;
@@ -542,7 +1234,7 @@ export async function akmUpdate(input) {
             return false;
         });
         if (websiteMatch)
-            return updateWebsiteSource(stashDir, target, all, websiteMatch);
+            return updateWebsiteSource(stashDir, target, all, websiteMatch, allowInsecure);
         // Plain npm source (bundle without a lock) — sync via the registry
         // pipeline and promote to a managed install (see
         // managedInstallViewOfPlainNpm's doc comment for why npm can't stay
@@ -557,80 +1249,132 @@ export async function akmUpdate(input) {
             return false;
         });
         if (npmMatch) {
-            const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(npmMatch), force, yes, stashDir);
+            const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(npmMatch), force, yes, stashDir, allowInsecure);
             return buildUpdateResponse(stashDir, target, all, [updated.item], { index: updated.index });
         }
+        const filesystemMatch = stashes.find((source) => {
+            if (source.type !== "filesystem")
+                return false;
+            if (source.name === target)
+                return true;
+            return resolvedPath !== undefined && source.path !== undefined && path.resolve(source.path) === resolvedPath;
+        });
+        if (filesystemMatch)
+            return updateFilesystemSource(stashDir, target, all, filesystemMatch);
     }
     const enabledManagedInstalls = all
         ? managedInstalls.filter((managed) => config.bundles?.[managed.bundleKey]?.enabled !== false)
         : managedInstalls;
     const selected = selectManagedTargets(config, enabledManagedInstalls, target, all);
     const processed = [];
-    let latestManagedIndex;
+    const plainSynced = [];
+    const skipped = [];
+    let latestIndex;
     for (const managed of selected) {
-        const updated = await updateManagedInstall(managed, force, yes, stashDir);
-        processed.push(updated.item);
-        latestManagedIndex = updated.index;
+        try {
+            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowInsecure);
+            processed.push(updated.item);
+            latestIndex = updated.index;
+        }
+        catch (error) {
+            if (!all)
+                throw error;
+            skipped.push(updateFailureOutcome(managed.installId, sourceKindForInstall(managed.source), error));
+        }
     }
     // `--all` must account for EVERY configured source, not only the
     // registry-managed (lock-backed) ones (R-015) — `selectManagedTargets`
     // above returns only `installs` for `all`, so plain sources were
     // previously never even looked at. Git/npm plain sources are synced here
-    // too (git in place; npm promoted to managed, same as the single-target
-    // path above); website/filesystem sources have no `--all` sync path, so
-    // they are reported as skipped with the same explanatory wording
-    // `selectManagedTargets` already uses for a single unmatched target.
-    let plainSynced;
-    let skipped;
-    let sawGitSync = false;
+    // too (git and website through staged promotion; npm promoted to managed,
+    // same as the single-target path above). Filesystem sources reflect their
+    // files in place and are reported as intentionally skipped.
     if (all) {
         const managedKeys = new Set(managedInstalls.map((m) => m.bundleKey));
         const plainSources = getSources(config).filter((source) => source.enabled !== false && !managedKeys.has(source.name ?? ""));
-        plainSynced = [];
-        skipped = [];
+        const filesystemSources = [];
         for (const plain of plainSources) {
             const id = plain.name ?? plain.path ?? plain.url ?? "";
             try {
                 if (plain.type === "git") {
-                    plainSynced.push(await syncGitPlainSource(plain));
-                    sawGitSync = true;
+                    const updated = await syncGitPlainSource(plain, stashDir, allowInsecure);
+                    plainSynced.push(updated.item);
+                    latestIndex = updated.index;
                 }
                 else if (plain.type === "npm") {
-                    const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(plain), force, yes, stashDir);
+                    const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(plain), force, yes, stashDir, allowInsecure);
                     processed.push(updated.item);
-                    latestManagedIndex = updated.index;
+                    latestIndex = updated.index;
                 }
                 else if (plain.type === "website") {
-                    skipped.push({
-                        id,
-                        kind: "website",
-                        reason: `website caching not yet implemented for --all; run \`akm bundle update ${id}\` to re-mirror this source individually.`,
-                    });
+                    const updated = await syncWebsitePlainSource(plain, stashDir, allowInsecure);
+                    plainSynced.push(updated.item);
+                    latestIndex = updated.index;
                 }
                 else {
-                    skipped.push({
-                        id,
-                        kind: plain.type,
-                        reason: "reflects your files in place and has no remote to sync; run `akm index` to refresh the search index.",
-                    });
+                    filesystemSources.push(plain);
                 }
             }
-            catch (err) {
-                skipped.push({
-                    id,
-                    kind: plain.type,
-                    reason: `sync failed: ${err instanceof Error ? err.message : String(err)}`,
-                });
+            catch (error) {
+                skipped.push(updateFailureOutcome(id, plain.type, error));
+            }
+        }
+        if (filesystemSources.length > 0) {
+            try {
+                // A remote source may have reconciled before a later source finished
+                // hydrating, so an incomplete intermediate result is not authoritative
+                // for the final `--all` outcome. Retry once after every source update;
+                // a genuinely missing filesystem root remains incomplete and is
+                // reported below without claiming reconciliation.
+                if (!latestIndex?.scanComplete)
+                    latestIndex = await akmIndex({ stashDir, hydrateSources: false });
+                if (latestIndex.scanComplete) {
+                    for (const source of filesystemSources) {
+                        plainSynced.push({
+                            id: source.name ?? source.path ?? "",
+                            kind: "filesystem",
+                            ref: source.path ?? source.name ?? "",
+                        });
+                    }
+                }
+                else {
+                    for (const source of filesystemSources) {
+                        skipped.push(incompleteFilesystemOutcome(source.name ?? source.path ?? ""));
+                    }
+                }
+            }
+            catch (error) {
+                for (const source of filesystemSources) {
+                    skipped.push(updateFailureOutcome(source.name ?? source.path ?? "", "filesystem", error));
+                }
             }
         }
     }
     return buildUpdateResponse(stashDir, target, all, processed, {
-        full: sawGitSync,
         plainSynced,
         skipped,
-        ...(!sawGitSync && latestManagedIndex ? { index: latestManagedIndex } : {}),
+        index: latestIndex ?? readCurrentIndexSummary(),
     });
 }
+function sourceKindForInstall(source) {
+    if (source === "local")
+        return "filesystem";
+    if (source === "github")
+        return "git";
+    return source;
+}
+function updateFailureOutcome(id, kind, error) {
+    const code = error instanceof AkmError ? error.code : undefined;
+    const status = code === "DANGEROUS_ENV_KEY" || code === "DANGEROUS_ENV_AUDIT_FAILED" ? "blocked" : "failed";
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+        id,
+        kind,
+        status,
+        ...(code ? { code } : {}),
+        reason: `${status}: ${message}`,
+    };
+}
 function selectManagedTargets(config, installs, target, all) {
     if (all && target) {
         throw new UsageError("Specify either <target> or --all, not both.", "MISSING_OR_AMBIGUOUS_TARGET");
@@ -643,26 +1387,6 @@ function selectManagedTargets(config, installs, target, all) {
     const found = resolveManagedTarget(config, target);
     if (found)
         return [found];
-    // Give a helpful message when the target names a plain (non-managed) source.
-    const stashes = getSources(config);
-    const isUrl = target.startsWith("http://") || target.startsWith("https://");
-    const resolvedPath = !isUrl ? path.resolve(target) : undefined;
-    const stashMatch = stashes.find((s) => {
-        if (isUrl && s.url === target)
-            return true;
-        if (resolvedPath && s.path && path.resolve(s.path) === resolvedPath)
-            return true;
-        if (s.name === target)
-            return true;
-        return false;
-    });
-    if (stashMatch) {
-        if (stashMatch.type === "website") {
-            throw new UsageError(`"${target}" is a website source — website caching not yet implemented for --all. ` +
-                `Run \`akm bundle update ${target}\` to re-mirror this source individually.`, "TARGET_NOT_UPDATABLE");
-        }
-        throw new UsageError(`"${target}" is a local directory — it reflects your files in place. To refresh the search index, run: akm index`, "TARGET_NOT_UPDATABLE");
-    }
     throw new NotFoundError(`No matching source for target: ${target}`, "SOURCE_NOT_FOUND");
 }
 /**