akm-cli 0.9.12 → 0.9.13

package/dist/scripts/akm-migrate.js

@@ -7042,7 +7042,8 @@ var init_errors = __esm(() => {
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
     UNSAFE_STASH_DIR: "Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The bundle directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc, /var, ~/.config, or ~/.ssh.",
     UNKNOWN_IMPROVE_STRATEGY: "Pass one of the listed strategy names to `--strategy`, or define it under `improve.strategies`. Names are case-sensitive.",
-    EXECUTION_NOT_AUTHORIZED: "Change the selected tools or update the machine/user execution policy, then retry."
+    EXECUTION_NOT_AUTHORIZED: "Change the selected tools or update the machine/user execution policy, then retry.",
+    SECRET_REFERENCE_UNRESOLVED: "Check the secret exists (`akm secret list`) and the name after `secret://` matches, or run `akm secret set <name> <value>` to store it."
   };
   COMPOSITION_INVALID_MULTI_JOB_HINT = "AKM workflows support exactly one job per source, with no needs: between jobs. Split the extra job(s) into " + "their own workflow file, and compose them with uses: workflows/<ref> instead.";
   USAGE_HINTS = {
@@ -7064,7 +7065,8 @@ var init_errors = __esm(() => {
     INPUT_BINDING_INVALID: "Check the step's with: keys against the target's declared inputs.",
     TASK_TARGET_UNSUPPORTED: "Task definitions support command, script, workflow, and shell (run:) targets; akm/command is layered by callers.",
     WORKFLOW_IR_VERSION_UNSUPPORTED: "Abandon the run with `akm workflow abandon <id>`, then start it again from the workflow source \u2014 a frozen plan this akm cannot execute is not re-executable in place.",
-    WORKFLOW_OUTPUT_INVALID: "Check each `outputs:` entry's `from:` against the step artifact it names, and its `schema:` against the value that step actually promotes."
+    WORKFLOW_OUTPUT_INVALID: "Check each `outputs:` entry's `from:` against the step artifact it names, and its `schema:` against the value that step actually promotes.",
+    RUN_LEASE_HELD: "Wait for the named engine invocation to finish or for the lease to expire, then retry. `akm workflow status <id>` shows the current lease."
   };
   NOT_FOUND_HINTS = {
     ASSET_NOT_FOUND: "Run `akm search <query>` or `akm index` to refresh the index.",
@@ -8388,6 +8390,17 @@ function parseRefInput(raw) {
   }
   return { type: parts.type, name: parts.name, origin: ref.bundle };
 }
+function isFullRefInput(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed)
+    return false;
+  try {
+    const parsed = parseBundleRef(trimmed);
+    return parsed.bundle !== undefined || typeNameFromConceptId(parsed.conceptId) !== undefined;
+  } catch {
+    return false;
+  }
+}
 var init_resolve_ref = __esm(() => {
   init_errors();
   init_asset_placement();
@@ -12414,7 +12427,7 @@ function bindStepSections(headings, lines, bodyStartLine, totalLines, path24, de
     if (!declaredIds.has(h.text)) {
       errors3.push({
         line: h.line,
-        message: `Unexpected level-2 heading "## ${h.text}" on line ${h.line} \u2014 no step "${h.text}" is declared in frontmatter "steps:". Level-2 headings must exactly match a declared step id.`
+        message: `Unexpected level-2 heading "## ${h.text}" on line ${h.line} \u2014 no step "${h.text}" is declared in frontmatter "steps:". Level-2 headings must exactly match a declared step id. To document something that is not a step, use a level-3 heading.`
       });
       continue;
     }
@@ -68087,15 +68100,15 @@ ${this.boa_token}${this.audio_token.repeat(this._compute_audio_num_tokens(audio_
 });
 
 // src/indexer/walk/file-context.ts
-import fs45 from "fs";
-import path55 from "path";
+import fs47 from "fs";
+import path56 from "path";
 function buildFileContext(stashRoot, absPath) {
-  const relPath = toPosix(path55.relative(stashRoot, absPath));
-  const ext = path55.extname(absPath).toLowerCase();
-  const fileName = path55.basename(absPath);
-  const parentDirAbs = path55.dirname(absPath);
-  const parentDir = path55.basename(parentDirAbs);
-  const relDir = toPosix(path55.dirname(relPath));
+  const relPath = toPosix(path56.relative(stashRoot, absPath));
+  const ext = path56.extname(absPath).toLowerCase();
+  const fileName = path56.basename(absPath);
+  const parentDirAbs = path56.dirname(absPath);
+  const parentDir = path56.basename(parentDirAbs);
+  const relDir = toPosix(path56.dirname(relPath));
   const ancestorDirs = relDir === "." ? [] : relDir.split("/").filter((seg) => seg.length > 0);
   let cachedContent;
   let cachedFrontmatter;
@@ -68112,7 +68125,7 @@ function buildFileContext(stashRoot, absPath) {
     stashRoot,
     content() {
       if (cachedContent === undefined) {
-        cachedContent = fs45.readFileSync(absPath, "utf8");
+        cachedContent = fs47.readFileSync(absPath, "utf8");
       }
       return cachedContent;
     },
@@ -68127,7 +68140,7 @@ function buildFileContext(stashRoot, absPath) {
     },
     stat() {
       if (cachedStat === undefined) {
-        cachedStat = fs45.statSync(absPath);
+        cachedStat = fs47.statSync(absPath);
       }
       return cachedStat;
     }
@@ -70250,6 +70263,7 @@ function formatProposalDrainPlain(r) {
   const deferred = Array.isArray(r.deferred) ? r.deferred : [];
   const skippedByCap = Array.isArray(r.skippedByCap) ? r.skippedByCap : [];
   const staged = Array.isArray(r.staged) ? r.staged : [];
+  const failed = Array.isArray(r.failed) ? r.failed : [];
   const prefix = r.dryRun === true ? "[dry-run] " : "";
   const lines = [
     `${prefix}Drained proposal queue (strategy=${String(r.strategy ?? "?")}, policy=${policy}, applyMode=${applyMode})`,
@@ -70257,11 +70271,15 @@ function formatProposalDrainPlain(r) {
     `  rejected: ${rejected.length}`,
     `  deferred: ${deferred.length}`,
     `  skippedByCap: ${skippedByCap.length}`,
-    `  staged: ${staged.length}`
+    `  staged: ${staged.length}`,
+    `  failed: ${failed.length}`
   ];
   for (const d of deferred) {
     lines.push(`    - ${String(d.id ?? "?")} (${String(d.reason ?? "?")})`);
   }
+  for (const f of failed) {
+    lines.push(`    ! ${String(f.id ?? "?")} (${String(f.reason ?? "?")}): ${String(f.detail ?? "?")}`);
+  }
   appendLoweringNotices(lines, r);
   return lines.join(`
 `).trimEnd();
@@ -75483,12 +75501,16 @@ var httpUrl = exports_external.string().refine((v) => v.startsWith("http://") ||
 });
 var ENGINE_NAME_PATTERN = new RegExp(ENGINE_NAME_PATTERN_SOURCE);
 var ENV_REFERENCE_PATTERN = /^\$[A-Za-z_][A-Za-z0-9_]*$|^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+var SECRET_STORE_REFERENCE_PATTERN = /^secret:\/\/(.+)$/;
 var engineName = exports_external.string().max(63).regex(ENGINE_NAME_PATTERN, "names must be lowercase kebab-case and must not begin with reserved akm-");
+function isApiKeyReference(value) {
+  return ENV_REFERENCE_PATTERN.test(value) || SECRET_STORE_REFERENCE_PATTERN.test(value);
+}
 function symbolicOrWarnApiKey(label) {
   return exports_external.string().superRefine((value) => {
-    if (ENV_REFERENCE_PATTERN.test(value))
+    if (isApiKeyReference(value))
       return;
-    warnOnce(`config:literal-api-key:${label}`, `A ${label} in config.json is a literal API key, not a $VAR/\${VAR} reference; using it as configured. Prefer \`akm config set ...apiKey '$VAR'\` (with the corresponding env var set) \u2014 see docs/reference/data-and-telemetry.md.`);
+    warnOnce(`config:literal-api-key:${label}`, `A ${label} in config.json is a literal API key, not a $VAR/\${VAR}/secret:// reference; using it as configured. Prefer \`akm config set ...apiKey '$VAR'\` (with the corresponding env var set) or \`secret://<name>\` (with \`akm secret set <name> ...\`) \u2014 see docs/reference/data-and-telemetry.md.`);
   });
 }
 var chatCompletionsEndpoint = exports_external.string().superRefine((value, ctx) => {
@@ -76656,11 +76678,19 @@ function getSources(config) {
 function loadConfig() {
   return loadUserConfig();
 }
-function resolveSecret(value) {
+function resolveSecret(value, resolveFromStore) {
   if (value === undefined)
     return;
   if (typeof value !== "string")
     return value;
+  const storeRef = SECRET_STORE_REFERENCE_PATTERN.exec(value)?.[1];
+  if (storeRef !== undefined) {
+    const resolved = resolveFromStore?.(storeRef) ?? null;
+    if (resolved === null) {
+      throw new ConfigError(`Secret store reference "${value}" did not resolve to a stored value.`, "SECRET_REFERENCE_UNRESOLVED");
+    }
+    return resolved;
+  }
   if (!value.includes("$"))
     return value;
   return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, braced, bare) => {
@@ -78545,9 +78575,9 @@ function listTxnJournalsTolerant(predicate) {
 
 // src/commands/proposal/repository.ts
 import { createHash as createHash9, randomUUID as randomUUID6 } from "crypto";
-import fs47 from "fs";
+import fs49 from "fs";
 init_dist();
-import path60 from "path";
+import path61 from "path";
 
 // src/core/adapter/adapters/agent-skills-adapter.ts
 init_frontmatter();
@@ -92631,8 +92661,8 @@ init_warn();
 init_write_provenance();
 
 // src/indexer/index-written-assets.ts
-import fs46 from "fs";
-import path58 from "path";
+import fs48 from "fs";
+import path59 from "path";
 init_errors();
 init_paths();
 init_warn();
@@ -93669,6 +93699,127 @@ function redactSensitiveText(text, sensitiveValues) {
 
 // src/llm/embedders/remote.ts
 init_warn();
+
+// src/sources/snapshot-fetchers/secret-seam.ts
+import fs45 from "fs";
+
+// src/core/env-secret-ref.ts
+import fs43 from "fs";
+import path54 from "path";
+
+// src/registry/origin-resolve.ts
+init_asset_ref();
+function resolveSourcesForOrigin(origin, allSources) {
+  if (!origin)
+    return allSources;
+  const installations = deriveInstallations(allSources);
+  return allSources.filter((_, index) => installations[index]?.id === origin);
+}
+
+// src/core/asset/asset-create.ts
+init_errors();
+function normalizeCreateSubPath(subPath) {
+  if (subPath === undefined)
+    return "";
+  const trimmed = subPath.trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (!trimmed)
+    return "";
+  if (trimmed.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new UsageError("--path must be a relative directory without '.' or '..' segments.");
+  }
+  return trimmed;
+}
+function assertFlatAssetName(name) {
+  if (name?.replace(/\\/g, "/").replace(/\.md$/i, "").includes("/")) {
+    throw new UsageError("Asset --name must be a flat name without '/'. Use --path to choose a subdirectory " + "(e.g. --path personal --name grocery-list).");
+  }
+}
+function combineCreatePath(subPath, baseName) {
+  return subPath ? `${subPath}/${baseName}` : baseName;
+}
+
+// src/core/env-secret-ref.ts
+init_asset_placement();
+init_resolve_ref();
+init_common();
+init_errors();
+function assertNotRemovedVaultRef(ref) {
+  const boundary = ref.indexOf("//");
+  const bare = boundary >= 0 ? ref.slice(boundary + 2) : ref;
+  if (/^vault[:/]/.test(bare.trim())) {
+    throw new UsageError("The `vault` asset type was removed in 0.9.0 \u2014 use `env/` (whole .env config) or `secrets/` (a single value).", "INVALID_FLAG_VALUE");
+  }
+}
+function assertNotColonRef(ref, aliases, replacement) {
+  const boundary = ref.indexOf("//");
+  const bare = (boundary >= 0 ? ref.slice(boundary + 2) : ref).trim();
+  const colon = bare.indexOf(":");
+  if (colon <= 0)
+    return;
+  const head = bare.slice(0, colon).toLowerCase();
+  if (!aliases.includes(head))
+    return;
+  const name = bare.slice(colon + 1);
+  throw new UsageError(`The \`${head}:\` ref spelling was removed in 0.9.0 \u2014 use the slash form instead: \`${replacement}${name}\`.`, "INVALID_FLAG_VALUE");
+}
+function findEnvSource(origin, type, name) {
+  const sources = resolveSourceEntries(undefined, loadConfig());
+  if (sources.length === 0) {
+    throw new UsageError("No bundles configured. Run `akm bundle create` to create your working bundle.");
+  }
+  const candidates = origin ? resolveSourcesForOrigin(origin, sources) : sources;
+  const typeDir = type === "env" ? "env" : "secrets";
+  const member = candidates.find((source) => fs43.existsSync(assetPathForName(type, path54.join(source.path, typeDir), name)));
+  if (member)
+    return member;
+  if (!origin) {
+    const fallback = candidates[0];
+    if (fallback)
+      return fallback;
+    throw new UsageError("No bundles configured. Run `akm bundle create` to create your working bundle.");
+  }
+  const named = candidates[0];
+  if (!named) {
+    throw new NotFoundError(`Source not found for origin: ${origin}`);
+  }
+  return named;
+}
+function parseSecretRef(ref) {
+  assertNotRemovedVaultRef(ref);
+  assertNotColonRef(ref, ["secret", "secrets"], "secrets/");
+  return parseRefInput(isFullRefInput(ref) ? ref : `secrets/${ref}`);
+}
+function resolveSecretPath(ref, create) {
+  const parsed = parseSecretRef(ref);
+  if (parsed.type !== "secret") {
+    throw new UsageError(`Expected a secret ref (secrets/<name>); got "${ref}".`);
+  }
+  if (create) {
+    assertFlatAssetName(parsed.name);
+    parsed.name = combineCreatePath(normalizeCreateSubPath(create.subPath), parsed.name);
+  }
+  const source = findEnvSource(parsed.origin, "secret", parsed.name);
+  const typeRoot = path54.join(source.path, "secrets");
+  const absPath = assetPathForName("secret", typeRoot, parsed.name);
+  if (!isWithin(absPath, typeRoot)) {
+    throw new UsageError(`Secret name "${parsed.name}" escapes the secrets directory.`);
+  }
+  return { name: parsed.name, absPath, source };
+}
+
+// src/sources/snapshot-fetchers/secret-seam.ts
+function resolveSecretFromStore(ref) {
+  try {
+    const { absPath } = resolveSecretPath(ref);
+    if (!fs45.existsSync(absPath))
+      return null;
+    return fs45.readFileSync(absPath, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/llm/embedders/remote.ts
 var DEFAULT_REMOTE_BATCH_SIZE = 100;
 var DEFAULT_TOKEN_BUDGET = 8000;
 function estimateTokenCount(text) {
@@ -93824,14 +93975,14 @@ class RemoteEmbedder {
   }
   buildHeaders() {
     const headers = { "Content-Type": "application/json" };
-    const resolvedKey = resolveSecret(this.config.apiKey);
+    const resolvedKey = resolveSecret(this.config.apiKey, resolveSecretFromStore);
     if (resolvedKey) {
       headers.Authorization = `Bearer ${resolvedKey}`;
     }
     return headers;
   }
   safeErrorBody(body) {
-    const resolvedKey = resolveSecret(this.config.apiKey);
+    const resolvedKey = resolveSecret(this.config.apiKey, resolveSecretFromStore);
     return redactSensitiveText(redactErrorBody(body), resolvedKey ? [resolvedKey] : []);
   }
 }
@@ -94067,7 +94218,7 @@ function publishTargetedEmbeddingMeta(db, config) {
 }
 
 // src/indexer/scan/drain-dir.ts
-import path57 from "path";
+import path58 from "path";
 init_common();
 init_recognition_util();
 
@@ -94076,8 +94227,8 @@ init_common();
 init_errors();
 init_recognition_util();
 init_warn();
-import fs43 from "fs";
-import path54 from "path";
+import fs46 from "fs";
+import path55 from "path";
 
 class WorkflowSourceRejectionError extends UsageError {
   sourcePaths;
@@ -94117,13 +94268,13 @@ class WorkflowSourcePathIdentityError extends WorkflowSourceRejectionError {
 function workflowNameForSourcePath(sourceRoot, adapterId, sourcePath) {
   if (adapterId !== "akm" && adapterId !== "akm-workflow")
     return;
-  const relativePath = toPosix(path54.relative(path54.resolve(sourceRoot), path54.resolve(sourcePath)));
+  const relativePath = toPosix(path55.relative(path55.resolve(sourceRoot), path55.resolve(sourcePath)));
   if (!isSafeRelativeName(relativePath))
     return;
   const ownedPath = adapterId === "akm" ? relativePath.replace(/^workflows\//, "") : relativePath;
   if (adapterId === "akm" && ownedPath === relativePath)
     return;
-  const extension = path54.posix.extname(ownedPath);
+  const extension = path55.posix.extname(ownedPath);
   if (!WORKFLOW_EXTENSIONS.includes(extension.toLowerCase()))
     return;
   return ownedPath;
@@ -94136,38 +94287,38 @@ function listWorkflowSourceFiles(sourceRoot, adapterId, name) {
     throw new UsageError("Workflow ref resolves outside the bundle root.", "PATH_ESCAPE_VIOLATION");
   }
   let realRoot;
-  const authoredRoot = path54.resolve(sourceRoot);
+  const authoredRoot = path55.resolve(sourceRoot);
   try {
-    realRoot = fs43.realpathSync(authoredRoot);
+    realRoot = fs46.realpathSync(authoredRoot);
   } catch {
     return [];
   }
-  const ownershipRoot = adapterId === "akm" ? path54.join(authoredRoot, "workflows") : authoredRoot;
-  const parent = path54.join(ownershipRoot, path54.dirname(canonicalName));
+  const ownershipRoot = adapterId === "akm" ? path55.join(authoredRoot, "workflows") : authoredRoot;
+  const parent = path55.join(ownershipRoot, path55.dirname(canonicalName));
   if (!isWithinResolved(parent, authoredRoot)) {
     throw new UsageError("Workflow ref resolves outside the bundle root.", "PATH_ESCAPE_VIOLATION");
   }
   let entries;
   try {
-    entries = fs43.readdirSync(parent, { withFileTypes: true });
+    entries = fs46.readdirSync(parent, { withFileTypes: true });
   } catch {
     return [];
   }
-  const basename = path54.basename(canonicalName);
+  const basename = path55.basename(canonicalName);
   const candidates = [];
   for (const entry of entries) {
     if (!entry.isFile() && !entry.isSymbolicLink())
       continue;
-    const extension = path54.extname(entry.name);
+    const extension = path55.extname(entry.name);
     const lowerExtension = extension.toLowerCase();
     if (!WORKFLOW_EXTENSIONS.includes(lowerExtension))
       continue;
     if (entry.name.slice(0, -extension.length) !== basename)
       continue;
-    const candidatePath = path54.join(parent, entry.name);
+    const candidatePath = path55.join(parent, entry.name);
     candidates.push({
       path: candidatePath,
-      relativePath: toPosix(path54.relative(authoredRoot, candidatePath)),
+      relativePath: toPosix(path55.relative(authoredRoot, candidatePath)),
       lowerExtension,
       extensionlessStem: entry.name.slice(0, -extension.length)
     });
@@ -94202,7 +94353,7 @@ function inspectWorkflowSourceCandidate(candidate, canonicalName, realRoot) {
   const issues = [];
   let authoredStat;
   try {
-    authoredStat = fs43.lstatSync(candidate.path);
+    authoredStat = fs46.lstatSync(candidate.path);
   } catch {
     issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     return { issues };
@@ -94214,21 +94365,21 @@ function inspectWorkflowSourceCandidate(candidate, canonicalName, realRoot) {
   }
   let realPath;
   try {
-    realPath = fs43.realpathSync(candidate.path);
+    realPath = fs46.realpathSync(candidate.path);
   } catch {
     issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     return { issues };
   }
-  const targetPath = toPosix(path54.relative(realRoot, realPath));
+  const targetPath = toPosix(path55.relative(realRoot, realPath));
   const contained2 = isWithinResolved(realPath, realRoot);
   if (!contained2)
     issues.push(new WorkflowSourcePathIdentityError(candidate.relativePath, targetPath));
-  if (isLink && path54.extname(realPath).toLowerCase() !== candidate.lowerExtension) {
+  if (isLink && path55.extname(realPath).toLowerCase() !== candidate.lowerExtension) {
     issues.push(new WorkflowSourceLinkIdentityError(candidate.relativePath, targetPath));
   }
   if (contained2) {
     try {
-      if (!fs43.statSync(realPath).isFile())
+      if (!fs46.statSync(realPath).isFile())
         issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     } catch {
       issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
@@ -94256,11 +94407,11 @@ function normalizeName2(name) {
   return name.replaceAll("\\", "/");
 }
 function isSafeRelativeName(name) {
-  return name.length > 0 && !path54.posix.isAbsolute(name) && name !== ".." && !name.startsWith("../") && path54.posix.normalize(name) === name;
+  return name.length > 0 && !path55.posix.isAbsolute(name) && name !== ".." && !name.startsWith("../") && path55.posix.normalize(name) === name;
 }
 function isWithinResolved(candidate, root2) {
-  const relative = path54.relative(root2, path54.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path54.isAbsolute(relative);
+  const relative = path55.relative(root2, path55.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path55.isAbsolute(relative);
 }
 
 // src/indexer/scan/drain-dir.ts
@@ -94269,13 +94420,13 @@ init_metadata();
 init_file_context();
 
 // src/indexer/scan/doc-to-entry.ts
-import path56 from "path";
+import path57 from "path";
 function indexDocumentToStashEntry(doc) {
   const dj = doc.documentJson ?? {};
   const entry = {
     name: doc.name,
     type: doc.type,
-    filename: path56.basename(doc.path ?? "")
+    filename: path57.basename(doc.path ?? "")
   };
   if (doc.description !== undefined)
     entry.description = doc.description;
@@ -94395,7 +94546,7 @@ function drainDirDocuments(adapter, component, fileContexts) {
         throw error2;
       rejectedConceptIds.add(adapter.id === "akm" ? `workflows/${canonicalName}` : canonicalName);
       for (const relativePath of error2.sourcePaths) {
-        rejectedPaths.add(path57.join(component.root, relativePath));
+        rejectedPaths.add(path58.join(component.root, relativePath));
       }
       warnings.push(error2.message);
     }
@@ -94457,7 +94608,7 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
       if (isPathAbsent(dbPath))
         return true;
       const files = filePaths.filter((f) => {
-        const rel = path58.relative(stashDir, f);
+        const rel = path59.relative(stashDir, f);
         return !rel.split(/[\\/]+/).some((segment) => segment.startsWith("."));
       });
       if (files.length === 0)
@@ -94471,10 +94622,10 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
       const unindexable = new Set;
       const rejectedConceptIds = new Set;
       for (const file of files) {
-        if (!fs46.existsSync(file)) {
+        if (!fs48.existsSync(file)) {
           let authoredDanglingSymlink = false;
           try {
-            authoredDanglingSymlink = fs46.lstatSync(file).isSymbolicLink();
+            authoredDanglingSymlink = fs48.lstatSync(file).isSymbolicLink();
           } catch {}
           if (!authoredDanglingSymlink) {
             unindexable.add(file);
@@ -94525,7 +94676,7 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
           for (const { file, entry, conceptId, contentHash } of pairs) {
             let entryWithSize = entry;
             try {
-              entryWithSize = { ...entry, fileSize: fs46.statSync(file).size };
+              entryWithSize = { ...entry, fileSize: fs48.statSync(file).size };
             } catch {}
             const provenance = deriveEntryProvenance({ bundleId: component.id, componentId: component.id, adapterId: component.adapter }, entry.type, entry.name, conceptId);
             const supersededIds = db.prepare("SELECT id FROM entries WHERE file_path = ? AND item_ref <> ?").all(file, provenance.itemRef);
@@ -94558,7 +94709,7 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
 init_asset_placement();
 init_asset_ref();
 init_warn();
-import path59 from "path";
+import path60 from "path";
 function changesToStored(changes) {
   return changes.map((c, i) => ({
     path: c.path,
@@ -94611,10 +94762,10 @@ function currentProposalTarget(value) {
   if (typeof value !== "object" || value === null)
     throw new Error("Proposal metadata has an invalid proposedTarget.");
   const target = value;
-  if (typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path59.isAbsolute(target.root)) {
+  if (typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path60.isAbsolute(target.root)) {
     throw new Error("Proposal metadata has an invalid proposedTarget.");
   }
-  return { source: target.source, root: path59.resolve(target.root) };
+  return { source: target.source, root: path60.resolve(target.root) };
 }
 function invalidPresentField(name) {
   throw new Error(`Proposal metadata has an invalid ${name}.`);
@@ -94654,7 +94805,7 @@ function validatePresentMetadata(meta) {
   }
   if (Object.hasOwn(meta, "acceptedTarget")) {
     const target = meta.acceptedTarget;
-    if (typeof target !== "object" || target === null || typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path59.isAbsolute(target.root) || typeof target.path !== "string" || !path59.isAbsolute(target.path) || typeof target.contentHash !== "string") {
+    if (typeof target !== "object" || target === null || typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path60.isAbsolute(target.root) || typeof target.path !== "string" || !path60.isAbsolute(target.path) || typeof target.contentHash !== "string") {
       invalidPresentField("acceptedTarget");
     }
   }
@@ -95388,12 +95539,12 @@ function proposalHash(content) {
   return createHash9("sha256").update(content).digest("hex");
 }
 function proposalFileHash(filePath) {
-  return proposalHash(fs47.readFileSync(filePath));
+  return proposalHash(fs49.readFileSync(filePath));
 }
 function sameProposalFile(left, right) {
   try {
-    const leftStat = fs47.statSync(left);
-    const rightStat = fs47.statSync(right);
+    const leftStat = fs49.statSync(left);
+    const rightStat = fs49.statSync(right);
     return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
   } catch {
     return false;
@@ -95402,20 +95553,20 @@ function sameProposalFile(left, right) {
 function cleanupProposalPublication(p) {
   for (const filePath of [p.publishPath, p.displacedPath]) {
     try {
-      fs47.rmSync(filePath, { force: true });
+      fs49.rmSync(filePath, { force: true });
     } catch (error2) {
       warn(`[proposals] transaction publication cleanup failed at ${filePath}: ${error2 instanceof Error ? error2.message : String(error2)}`);
     }
   }
-  fsyncTxnDir(path60.dirname(p.assetPath));
+  fsyncTxnDir(path61.dirname(p.assetPath));
 }
 function rollbackPreparedProposalTransaction(txn) {
   const p = txn.journal.payload;
-  const currentHash = fs47.existsSync(p.assetPath) ? proposalFileHash(p.assetPath) : null;
-  if (!fs47.existsSync(p.displacedPath)) {
+  const currentHash = fs49.existsSync(p.assetPath) ? proposalFileHash(p.assetPath) : null;
+  if (!fs49.existsSync(p.displacedPath)) {
     if (p.originalHash === null) {
       if (currentHash === p.publishedHash && sameProposalFile(p.assetPath, p.publishPath)) {
-        fs47.unlinkSync(p.assetPath);
+        fs49.unlinkSync(p.assetPath);
         recordWrittenPath(p.assetPath);
       } else if (currentHash !== null) {
         throw new Error(`Cannot roll back proposal transaction: target was created externally.`);
@@ -95427,30 +95578,30 @@ function rollbackPreparedProposalTransaction(txn) {
     return;
   }
   if (currentHash === p.publishedHash) {
-    fs47.unlinkSync(p.assetPath);
+    fs49.unlinkSync(p.assetPath);
     recordWrittenPath(p.assetPath);
   } else if (currentHash !== null && currentHash !== p.originalHash) {
     throw new Error(`Cannot roll back proposal transaction: ${p.assetPath} diverged.`);
   }
-  if (fs47.existsSync(p.displacedPath)) {
-    if (fs47.existsSync(p.assetPath)) {
+  if (fs49.existsSync(p.displacedPath)) {
+    if (fs49.existsSync(p.assetPath)) {
       throw new Error(`Cannot restore proposal backup: ${p.assetPath} is occupied.`);
     }
-    fs47.linkSync(p.displacedPath, p.assetPath);
+    fs49.linkSync(p.displacedPath, p.assetPath);
     recordWrittenPath(p.assetPath);
   }
   cleanupProposalPublication(p);
 }
 function validatePublishedProposal(p) {
-  if (!fs47.existsSync(p.assetPath) || proposalFileHash(p.assetPath) !== p.publishedHash) {
+  if (!fs49.existsSync(p.assetPath) || proposalFileHash(p.assetPath) !== p.publishedHash) {
     throw new Error(`Cannot recover proposal ${p.proposalId}: published asset diverged.`);
   }
 }
 function persistProposalTransactionState(txn, proposal, ctx) {
   const p = txn.journal.payload;
   const decidedAt = txn.journal.decidedAt;
-  const backupContent = p.backupPath ? fs47.readFileSync(p.backupPath, "utf8") : undefined;
-  const publishedContent = fs47.readFileSync(p.contentPath, "utf8");
+  const backupContent = p.backupPath ? fs49.readFileSync(p.backupPath, "utf8") : undefined;
+  const publishedContent = fs49.readFileSync(p.contentPath, "utf8");
   return withProposalsDb(p.stashDir, ctx, (db) => withImmediateTransaction(db, () => {
     const current = requireProposal(db, p.stashDir, p.proposalId);
     if (p.operation === "accept") {
@@ -95468,7 +95619,7 @@ function persistProposalTransactionState(txn, proposal, ctx) {
         payload: { ...proposal.payload, content: publishedContent },
         changes: [
           {
-            path: path60.relative(txn.journal.root, p.assetPath),
+            path: path61.relative(txn.journal.root, p.assetPath),
             op: p.originalHash === null ? "create" : "update",
             after: publishedContent
           }
@@ -95539,7 +95690,7 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
   cleanupProposalPublication(p);
   if (txn.journal.phase === "asset-published") {
     const commitRoot = target.source.repoPath ?? target.source.path;
-    const commitPath = path60.relative(commitRoot, p.assetPath).replaceAll(path60.sep, "/");
+    const commitPath = path61.relative(commitRoot, p.assetPath).replaceAll(path61.sep, "/");
     publishWriteTargetTransaction(target, p.gitPublication, {
       transactionId: txn.journal.transactionId,
       message: `${p.operation === "accept" ? "Update" : "Revert"} ${p.ref}`,
@@ -95576,8 +95727,8 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
 function fenceProposalTxnJournal(journal, txnDir, root2) {
   const p = journal.payload;
   const refIdentity = proposalRefIdentity(p.ref);
-  if (!["accept", "revert"].includes(p.operation) || !p.targetSource || !p.targetKind || refIdentity?.bundle === undefined || !isWithin(p.assetPath, root2) || ![p.contentPath, p.backupPath].filter((candidate) => candidate !== null).every((candidate) => isWithin(candidate, txnDir)) || ![p.publishPath, p.displacedPath].every((candidate) => isWithin(candidate, root2) && path60.dirname(candidate) === path60.dirname(p.assetPath))) {
-    throw new Error(`Refusing unsafe proposal transaction journal at ${path60.join(txnDir, "journal.json")}.`);
+  if (!["accept", "revert"].includes(p.operation) || !p.targetSource || !p.targetKind || refIdentity?.bundle === undefined || !isWithin(p.assetPath, root2) || ![p.contentPath, p.backupPath].filter((candidate) => candidate !== null).every((candidate) => isWithin(candidate, txnDir)) || ![p.publishPath, p.displacedPath].every((candidate) => isWithin(candidate, root2) && path61.dirname(candidate) === path61.dirname(p.assetPath))) {
+    throw new Error(`Refusing unsafe proposal transaction journal at ${path61.join(txnDir, "journal.json")}.`);
   }
 }
 function resolveProposalRecoveryTarget(config, journal) {
@@ -95677,8 +95828,8 @@ async function recoverStaleTxns(stashDir) {
 }
 
 // scripts/akm-migrate/migrate/writer-relocation.ts
-import fs48 from "fs";
-import path61 from "path";
+import fs50 from "fs";
+import path62 from "path";
 init_paths();
 function relocationSpecs(stashDir) {
   return [
@@ -95698,7 +95849,7 @@ function mutexSiblingName(lockName) {
 function fileCountIfExists(dir) {
   let entries;
   try {
-    entries = fs48.readdirSync(dir, { withFileTypes: true });
+    entries = fs50.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -95706,7 +95857,7 @@ function fileCountIfExists(dir) {
 }
 function statFileIfExists(filePath) {
   try {
-    const stat = fs48.statSync(filePath);
+    const stat = fs50.statSync(filePath);
     return stat.isFile() ? stat : undefined;
   } catch {
     return;
@@ -95716,8 +95867,8 @@ function classifyLockArtifacts(akmDir) {
   const removable = [];
   const skipped = [];
   for (const lockName of LOCK_NAMES) {
-    const lockPath = path61.join(akmDir, lockName);
-    const mutexPath = path61.join(akmDir, mutexSiblingName(lockName));
+    const lockPath = path62.join(akmDir, lockName);
+    const mutexPath = path62.join(akmDir, mutexSiblingName(lockName));
     const lockStat = statFileIfExists(lockPath);
     const mutexStat = statFileIfExists(mutexPath);
     if (!lockStat) {
@@ -95743,11 +95894,11 @@ function classifyLockArtifacts(akmDir) {
   return { removable, skipped };
 }
 function findWriterRelocationEntries(stashDir) {
-  const akmDir = path61.join(stashDir, ".akm");
+  const akmDir = path62.join(stashDir, ".akm");
   const directories = [];
   for (const spec of relocationSpecs(stashDir)) {
     const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
-    const oldPath = path61.join(akmDir, ...relativeParts);
+    const oldPath = path62.join(akmDir, ...relativeParts);
     const fileCount = fileCountIfExists(oldPath);
     if (fileCount === undefined || fileCount === 0)
       continue;
@@ -95758,36 +95909,36 @@ function findWriterRelocationEntries(stashDir) {
 }
 function moveFile(oldFilePath, newFilePath) {
   try {
-    fs48.renameSync(oldFilePath, newFilePath);
+    fs50.renameSync(oldFilePath, newFilePath);
   } catch (error2) {
     if (error2.code !== "EXDEV")
       throw error2;
-    fs48.copyFileSync(oldFilePath, newFilePath);
-    fs48.rmSync(oldFilePath, { force: true });
+    fs50.copyFileSync(oldFilePath, newFilePath);
+    fs50.rmSync(oldFilePath, { force: true });
   }
 }
 function moveDirectoryContents(entry) {
   const errors3 = [];
   let moved = 0;
-  fs48.mkdirSync(entry.newPath, { recursive: true });
+  fs50.mkdirSync(entry.newPath, { recursive: true });
   let names;
   try {
-    names = fs48.readdirSync(entry.oldPath).sort();
+    names = fs50.readdirSync(entry.oldPath).sort();
   } catch {
     return { key: entry.key, oldPath: entry.oldPath, newPath: entry.newPath, moved: 0, errors: [] };
   }
   for (const name of names) {
-    const oldFilePath = path61.join(entry.oldPath, name);
-    const newFilePath = path61.join(entry.newPath, name);
+    const oldFilePath = path62.join(entry.oldPath, name);
+    const newFilePath = path62.join(entry.newPath, name);
     let oldStat;
     try {
-      oldStat = fs48.lstatSync(oldFilePath);
+      oldStat = fs50.lstatSync(oldFilePath);
     } catch {
       continue;
     }
     if (!oldStat.isFile())
       continue;
-    if (fs48.existsSync(newFilePath))
+    if (fs50.existsSync(newFilePath))
       continue;
     try {
       moveFile(oldFilePath, newFilePath);
@@ -95800,13 +95951,13 @@ function moveDirectoryContents(entry) {
 }
 function removeIfEmptyDir(dir) {
   try {
-    if (fs48.readdirSync(dir).length === 0)
-      fs48.rmdirSync(dir);
+    if (fs50.readdirSync(dir).length === 0)
+      fs50.rmdirSync(dir);
   } catch {}
 }
 function removeLockArtifact(entry) {
   try {
-    fs48.rmSync(entry.path, { force: true });
+    fs50.rmSync(entry.path, { force: true });
     return { path: entry.path, removed: true };
   } catch (error2) {
     return { path: entry.path, removed: false, error: error2 instanceof Error ? error2.message : String(error2) };
@@ -95818,36 +95969,36 @@ function applyWriterRelocation(stashDir) {
   const lockResults = lockArtifacts.map(removeLockArtifact);
   for (const spec of relocationSpecs(stashDir)) {
     const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
-    removeIfEmptyDir(path61.join(stashDir, ".akm", ...relativeParts));
+    removeIfEmptyDir(path62.join(stashDir, ".akm", ...relativeParts));
   }
   return { directories: directoryResults, lockArtifacts: lockResults, skippedLocks };
 }
 
 // scripts/akm-migrate/task-migrate.ts
 import { randomUUID as randomUUID7 } from "crypto";
-import fs53 from "fs";
+import fs56 from "fs";
 import os5 from "os";
-import path64 from "path";
+import path65 from "path";
 init_errors();
 init_paths();
 
 // scripts/akm-migrate/migrate/task-files-to-v3.ts
 init_errors();
 import crypto6 from "crypto";
-import fs50 from "fs";
-import path62 from "path";
+import fs53 from "fs";
+import path63 from "path";
 
 // scripts/akm-migrate/migrate/durable-fs.ts
-import fs49 from "fs";
+import fs51 from "fs";
 function fsyncDirectoryPortable(directory) {
   if (process.platform === "win32")
     return;
   try {
-    const fd = fs49.openSync(directory, "r");
+    const fd = fs51.openSync(directory, "r");
     try {
-      fs49.fsyncSync(fd);
+      fs51.fsyncSync(fd);
     } finally {
-      fs49.closeSync(fd);
+      fs51.closeSync(fd);
     }
   } catch (cause) {
     const code = cause.code;
@@ -95861,25 +96012,25 @@ function migrationError(detail) {
   return new ConfigError(`Task migration to v3 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained2(root2, candidate) {
-  const relative = path62.relative(root2, candidate);
-  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
+  const relative = path63.relative(root2, candidate);
+  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
 }
 function realDirectory(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs53.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError(`${filePath} must be a real directory.`);
-  return fs50.realpathSync(filePath);
+  return fs53.realpathSync(filePath);
 }
 function snapshot(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs53.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError(`${filePath} must be a real file.`);
-  const bytes = fs50.readFileSync(filePath);
+  const bytes = fs53.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable(filePath) {
   try {
-    fs50.accessSync(filePath, fs50.constants.W_OK);
+    fs53.accessSync(filePath, fs53.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -95892,12 +96043,12 @@ function walkTasks(root2, tasksDir, out) {
     throw migrationError(`${root2.root} resolves outside bundle ${root2.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs50.realpathSync(directory);
+    const physicalDirectory = fs53.realpathSync(directory);
     if (!contained2(physicalRoot, physicalDirectory)) {
       throw migrationError(`${directory} resolves outside bundle ${root2.bundleId}.`);
     }
-    for (const entry of fs50.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path62.join(directory, entry.name);
+    for (const entry of fs53.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path63.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -95907,7 +96058,7 @@ function walkTasks(root2, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot(candidate);
-      const parent = path62.dirname(candidate);
+      const parent = path63.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -95923,9 +96074,9 @@ function walkTasks(root2, tasksDir, out) {
 function inspectTaskToV3Files(roots) {
   const files = [];
   for (const root2 of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root2.layout === "akm-task" ? root2.root : path62.join(root2.root, "tasks");
+    const tasksDir = root2.layout === "akm-task" ? root2.root : path63.join(root2.root, "tasks");
     try {
-      const stat = fs50.lstatSync(tasksDir);
+      const stat = fs53.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -95940,33 +96091,33 @@ function inspectTaskToV3Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath(filePath) {
-  return crypto6.createHash("sha256").update(path62.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto6.createHash("sha256").update(path63.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPath(backupRoot, filePath) {
-  return path62.join(backupRoot, "files", `${hashPath(filePath)}-${path62.basename(filePath)}`);
+  return path63.join(backupRoot, "files", `${hashPath(filePath)}-${path63.basename(filePath)}`);
 }
 function writeDurable(filePath, bytes, mode, exclusive = false) {
-  fs50.mkdirSync(path62.dirname(filePath), { recursive: true });
+  fs53.mkdirSync(path63.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs50.openSync(filePath, flags, mode);
+  const fd = fs53.openSync(filePath, flags, mode);
   try {
-    fs50.writeFileSync(fd, bytes);
-    fs50.fsyncSync(fd);
+    fs53.writeFileSync(fd, bytes);
+    fs53.fsyncSync(fd);
   } finally {
-    fs50.closeSync(fd);
+    fs53.closeSync(fd);
   }
-  fs50.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path62.dirname(filePath));
+  fs53.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path63.dirname(filePath));
 }
 function replaceAtomically(filePath, bytes, mode) {
-  const temporary = path62.join(path62.dirname(filePath), `.${path62.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
+  const temporary = path63.join(path63.dirname(filePath), `.${path63.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
   try {
     writeDurable(temporary, bytes, mode, true);
-    fs50.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path62.dirname(filePath));
+    fs53.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path63.dirname(filePath));
   } finally {
     try {
-      fs50.unlinkSync(temporary);
+      fs53.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -96005,7 +96156,7 @@ function applyTaskToV3MigrationPlan(plan, options) {
       const current = snapshot(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically(change.filePath, fs50.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically(change.filePath, fs53.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -96015,31 +96166,31 @@ function applyTaskToV3MigrationPlan(plan, options) {
 // scripts/akm-migrate/migrate/task-files-to-v4.ts
 init_errors();
 import crypto7 from "crypto";
-import fs51 from "fs";
-import path63 from "path";
+import fs55 from "fs";
+import path64 from "path";
 function migrationError2(detail) {
   return new ConfigError(`Task migration to v4 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained3(root2, candidate) {
-  const relative = path63.relative(root2, candidate);
-  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
+  const relative = path64.relative(root2, candidate);
+  return relative === "" || !relative.startsWith("..") && !path64.isAbsolute(relative);
 }
 function realDirectory2(filePath) {
-  const stat = fs51.lstatSync(filePath);
+  const stat = fs55.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError2(`${filePath} must be a real directory.`);
-  return fs51.realpathSync(filePath);
+  return fs55.realpathSync(filePath);
 }
 function snapshot2(filePath) {
-  const stat = fs51.lstatSync(filePath);
+  const stat = fs55.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError2(`${filePath} must be a real file.`);
-  const bytes = fs51.readFileSync(filePath);
+  const bytes = fs55.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable2(filePath) {
   try {
-    fs51.accessSync(filePath, fs51.constants.W_OK);
+    fs55.accessSync(filePath, fs55.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -96052,12 +96203,12 @@ function walkTasks2(root2, tasksDir, out) {
     throw migrationError2(`${root2.root} resolves outside bundle ${root2.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs51.realpathSync(directory);
+    const physicalDirectory = fs55.realpathSync(directory);
     if (!contained3(physicalRoot, physicalDirectory)) {
       throw migrationError2(`${directory} resolves outside bundle ${root2.bundleId}.`);
     }
-    for (const entry of fs51.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path63.join(directory, entry.name);
+    for (const entry of fs55.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path64.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -96067,7 +96218,7 @@ function walkTasks2(root2, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot2(candidate);
-      const parent = path63.dirname(candidate);
+      const parent = path64.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -96083,9 +96234,9 @@ function walkTasks2(root2, tasksDir, out) {
 function inspectTaskToV4Files(roots) {
   const files = [];
   for (const root2 of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root2.layout === "akm-task" ? root2.root : path63.join(root2.root, "tasks");
+    const tasksDir = root2.layout === "akm-task" ? root2.root : path64.join(root2.root, "tasks");
     try {
-      const stat = fs51.lstatSync(tasksDir);
+      const stat = fs55.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -96100,33 +96251,33 @@ function inspectTaskToV4Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath2(filePath) {
-  return crypto7.createHash("sha256").update(path63.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto7.createHash("sha256").update(path64.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPathV4(backupRoot, filePath) {
-  return path63.join(backupRoot, "files", `${hashPath2(filePath)}-${path63.basename(filePath)}`);
+  return path64.join(backupRoot, "files", `${hashPath2(filePath)}-${path64.basename(filePath)}`);
 }
 function writeDurable2(filePath, bytes, mode, exclusive = false) {
-  fs51.mkdirSync(path63.dirname(filePath), { recursive: true });
+  fs55.mkdirSync(path64.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs51.openSync(filePath, flags, mode);
+  const fd = fs55.openSync(filePath, flags, mode);
   try {
-    fs51.writeFileSync(fd, bytes);
-    fs51.fsyncSync(fd);
+    fs55.writeFileSync(fd, bytes);
+    fs55.fsyncSync(fd);
   } finally {
-    fs51.closeSync(fd);
+    fs55.closeSync(fd);
   }
-  fs51.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path63.dirname(filePath));
+  fs55.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path64.dirname(filePath));
 }
 function replaceAtomically2(filePath, bytes, mode) {
-  const temporary = path63.join(path63.dirname(filePath), `.${path63.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
+  const temporary = path64.join(path64.dirname(filePath), `.${path64.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
   try {
     writeDurable2(temporary, bytes, mode, true);
-    fs51.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path63.dirname(filePath));
+    fs55.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path64.dirname(filePath));
   } finally {
     try {
-      fs51.unlinkSync(temporary);
+      fs55.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -96165,7 +96316,7 @@ function applyTaskToV4MigrationPlan(plan, options) {
       const current = snapshot2(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically2(change.filePath, fs51.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically2(change.filePath, fs55.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -96177,12 +96328,12 @@ function expandTilde(value) {
   if (value === "~")
     return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path64.join(os5.homedir(), value.slice(2));
+    return path65.join(os5.homedir(), value.slice(2));
   return value;
 }
 function existingDirectory(target) {
   try {
-    return fs53.statSync(target).isDirectory();
+    return fs56.statSync(target).isDirectory();
   } catch (cause) {
     if (cause.code === "ENOENT")
       return false;
@@ -96203,21 +96354,21 @@ function taskRoots(config, resolutionBase = process.cwd()) {
     const source = sources.get(bundleId);
     if (!source)
       continue;
-    const configuredRoot = source.type === "filesystem" && source.path ? path64.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
+    const configuredRoot = source.type === "filesystem" && source.path ? path65.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
     if (!configuredRoot || !existingDirectory(configuredRoot))
       continue;
-    const bundleRoot = path64.resolve(configuredRoot);
+    const bundleRoot = path65.resolve(configuredRoot);
     const component = bundleComponentConfig(bundle);
-    const componentRoot = path64.resolve(bundleRoot, component?.root ?? ".");
-    const relative = path64.relative(bundleRoot, componentRoot);
-    if (relative === ".." || relative.startsWith(`..${path64.sep}`) || path64.isAbsolute(relative)) {
+    const componentRoot = path65.resolve(bundleRoot, component?.root ?? ".");
+    const relative = path65.relative(bundleRoot, componentRoot);
+    if (relative === ".." || relative.startsWith(`..${path65.sep}`) || path65.isAbsolute(relative)) {
       throw new ConfigError(`Task migration component root ${componentRoot} escapes bundle ${bundleId} at ${bundleRoot}.`, "INVALID_CONFIG_FILE");
     }
     if (!existingDirectory(componentRoot))
       continue;
     const adapter = component?.adapter ?? detectAdapterId(componentRoot, "");
     if (!component?.adapter && adapter === "") {
-      const flatTasks = fs53.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
+      const flatTasks = fs56.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
       if (flatTasks.length > 0) {
         throw new ConfigError(`Task migration cannot classify top-level task file(s) ${flatTasks.join(", ")} in bundle ${bundleId}; configure adapter "akm-task" or move them under tasks/.`, "INVALID_CONFIG_FILE");
       }
@@ -96289,8 +96440,8 @@ function applyTaskV3Migration() {
     const before = inspectCurrentTaskPlan();
     if (before.result.taskV3Migration.changed === 0)
       return before.result;
-    const backupRoot = path64.join(getDataDir(), "backups", "task-v3");
-    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path65.join(getDataDir(), "backups", "task-v3");
+    const backupPath = path65.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV3MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskPlan().result;
     if (after.taskV3Migration.changed > 0) {
@@ -96346,8 +96497,8 @@ function applyTaskV4Migration() {
     const before = inspectCurrentTaskV4Plan();
     if (before.result.taskV4Migration.changed === 0)
       return before.result;
-    const backupRoot = path64.join(getDataDir(), "backups", "task-v4");
-    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path65.join(getDataDir(), "backups", "task-v4");
+    const backupPath = path65.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV4MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskV4Plan().result;
     if (after.taskV4Migration.changed > 0) {