akm-cli 0.9.12 → 0.9.14-beta.1

package/dist/scripts/akm-migrate-node.js

@@ -7043,7 +7043,8 @@ var init_errors = __esm(() => {
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
     UNSAFE_STASH_DIR: "Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The bundle directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc, /var, ~/.config, or ~/.ssh.",
     UNKNOWN_IMPROVE_STRATEGY: "Pass one of the listed strategy names to `--strategy`, or define it under `improve.strategies`. Names are case-sensitive.",
-    EXECUTION_NOT_AUTHORIZED: "Change the selected tools or update the machine/user execution policy, then retry."
+    EXECUTION_NOT_AUTHORIZED: "Change the selected tools or update the machine/user execution policy, then retry.",
+    SECRET_REFERENCE_UNRESOLVED: "Check the secret exists (`akm secret list`) and the name after `secret://` matches, or run `akm secret set <name> <value>` to store it."
   };
   COMPOSITION_INVALID_MULTI_JOB_HINT = "AKM workflows support exactly one job per source, with no needs: between jobs. Split the extra job(s) into " + "their own workflow file, and compose them with uses: workflows/<ref> instead.";
   USAGE_HINTS = {
@@ -7065,7 +7066,8 @@ var init_errors = __esm(() => {
     INPUT_BINDING_INVALID: "Check the step's with: keys against the target's declared inputs.",
     TASK_TARGET_UNSUPPORTED: "Task definitions support command, script, workflow, and shell (run:) targets; akm/command is layered by callers.",
     WORKFLOW_IR_VERSION_UNSUPPORTED: "Abandon the run with `akm workflow abandon <id>`, then start it again from the workflow source — a frozen plan this akm cannot execute is not re-executable in place.",
-    WORKFLOW_OUTPUT_INVALID: "Check each `outputs:` entry's `from:` against the step artifact it names, and its `schema:` against the value that step actually promotes."
+    WORKFLOW_OUTPUT_INVALID: "Check each `outputs:` entry's `from:` against the step artifact it names, and its `schema:` against the value that step actually promotes.",
+    RUN_LEASE_HELD: "Wait for the named engine invocation to finish or for the lease to expire, then retry. `akm workflow status <id>` shows the current lease."
   };
   NOT_FOUND_HINTS = {
     ASSET_NOT_FOUND: "Run `akm search <query>` or `akm index` to refresh the index.",
@@ -8389,6 +8391,17 @@ function parseRefInput(raw) {
   }
   return { type: parts.type, name: parts.name, origin: ref.bundle };
 }
+function isFullRefInput(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed)
+    return false;
+  try {
+    const parsed = parseBundleRef(trimmed);
+    return parsed.bundle !== undefined || typeNameFromConceptId(parsed.conceptId) !== undefined;
+  } catch {
+    return false;
+  }
+}
 var init_resolve_ref = __esm(() => {
   init_errors();
   init_asset_placement();
@@ -9454,6 +9467,53 @@ function projectMarkdownContent(body, truncationInfo) {
     truncationInfo.truncated = text.length > MARKDOWN_CONTENT_MAX_CHARS;
   return truncateUnicodeSafe(text, MARKDOWN_CONTENT_MAX_CHARS);
 }
+function setMarkdownFragmentContent(entry, content) {
+  markdownFragmentProjectionEntries.add(entry);
+  if (content)
+    markdownFragmentContentByEntry.set(entry, content);
+}
+function getMarkdownFragmentContent(entry) {
+  return markdownFragmentContentByEntry.get(entry);
+}
+function hasMarkdownFragmentContent(entry) {
+  return markdownFragmentProjectionEntries.has(entry);
+}
+function projectMarkdownFragmentContent(raw) {
+  const lines = raw.split(/\r?\n/);
+  const parsed = parseFrontmatter(raw);
+  const start = parsed.frontmatter ? parsed.bodyStartLine - 1 : 0;
+  const projected = lines.map(() => "");
+  let fence;
+  const htmlComment = { inComment: false };
+  for (let index = start;index < lines.length; index++) {
+    const rawLine = lines[index];
+    if (fence) {
+      if (isMarkdownFenceClosing(rawLine, fence))
+        fence = undefined;
+      continue;
+    }
+    if (!htmlComment.inComment) {
+      const opening2 = parseMarkdownFenceOpening(rawLine);
+      if (opening2) {
+        fence = opening2;
+        continue;
+      }
+    }
+    let safe = stripMarkdownHtmlComments(rawLine, htmlComment);
+    const opening = parseMarkdownFenceOpening(safe.trim());
+    if (opening) {
+      fence = opening;
+      continue;
+    }
+    if (/^\s*\[[^\]]+\]:\s*\S+/.test(safe) || /^\s*<[^>]+>\s*$/.test(safe))
+      continue;
+    safe = stripMarkdownLinkDestinations(safe).replace(/<[^>]+>/g, " ");
+    projected[index] = safe.replace(/[ \t]+$/g, "");
+  }
+  const text = projected.join(`
+`);
+  return text.trim() ? text : undefined;
+}
 function applyPreContributorFields(entry, file, ctx, pkgMeta) {
   const ext = path19.extname(file).toLowerCase();
   if (pkgMeta) {
@@ -9474,7 +9534,9 @@ function applyPreContributorFields(entry, file, ctx, pkgMeta) {
       entry.parameters = fmParams;
     applyWikiFrontmatter(entry, parsed.data);
     applyProvenanceFrontmatter(entry, parsed.data);
-    if (entry.type !== "env" && entry.type !== "session" && !hasSessionMemoryMarker(parsed.data, parsed.content)) {
+    const safeForFragments = entry.type !== "env" && entry.type !== "session" && !hasSessionMemoryMarker(parsed.data, parsed.content);
+    setMarkdownFragmentContent(entry, safeForFragments ? projectMarkdownFragmentContent(content) : undefined);
+    if (safeForFragments) {
       const truncationInfo = { truncated: false };
       const contentProjection = projectMarkdownContent(parsed.content, truncationInfo);
       if (contentProjection) {
@@ -9592,7 +9654,7 @@ function extractDirTagsFromName(name) {
   }
   return Array.from(tags);
 }
-var SCOPE_KEYS, KNOWN_QUALITY_VALUES, warnedUnknownQualityValues, MARKDOWN_CONTENT_MAX_CHARS = 1e6, MAX_MARKDOWN_LINK_NESTING = 32;
+var SCOPE_KEYS, KNOWN_QUALITY_VALUES, warnedUnknownQualityValues, MARKDOWN_CONTENT_MAX_CHARS = 1e6, MAX_MARKDOWN_LINK_NESTING = 32, markdownFragmentContentByEntry, markdownFragmentProjectionEntries;
 var init_metadata = __esm(() => {
   init_asset_ref();
   init_frontmatter();
@@ -9601,6 +9663,8 @@ var init_metadata = __esm(() => {
   SCOPE_KEYS = ["user", "agent", "run", "channel"];
   KNOWN_QUALITY_VALUES = new Set(["generated", "curated", "enriched", "proposed"]);
   warnedUnknownQualityValues = new Set;
+  markdownFragmentContentByEntry = new WeakMap;
+  markdownFragmentProjectionEntries = new WeakSet;
 });
 
 // src/execution/record.ts
@@ -12174,6 +12238,9 @@ var init_schema2 = __esm(() => {
 });
 
 // src/core/asset/markdown.ts
+function markdownHeadingSlug(heading) {
+  return heading.trim().toLowerCase().replace(/<[^>]*>/g, "").replace(/[^\p{L}\p{N}\s_-]+/gu, "-").replace(/[\s_]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
 function parseMarkdownToc(content) {
   const lines = content.split(/\r?\n/);
   const headings = [];
@@ -12415,7 +12482,7 @@ function bindStepSections(headings, lines, bodyStartLine, totalLines, path24, de
     if (!declaredIds.has(h.text)) {
       errors3.push({
         line: h.line,
-        message: `Unexpected level-2 heading "## ${h.text}" on line ${h.line} — no step "${h.text}" is declared in frontmatter "steps:". Level-2 headings must exactly match a declared step id.`
+        message: `Unexpected level-2 heading "## ${h.text}" on line ${h.line} — no step "${h.text}" is declared in frontmatter "steps:". Level-2 headings must exactly match a declared step id. To document something that is not a step, use a level-3 heading.`
       });
       continue;
     }
@@ -36279,7 +36346,7 @@ var require_libvips = __commonJS((exports, module) => {
     SPDX-License-Identifier: Apache-2.0
   */
   var { spawnSync: spawnSync6 } = __require("node:child_process");
-  var { createHash: createHash9 } = __require("node:crypto");
+  var { createHash: createHash10 } = __require("node:crypto");
   var semverCoerce = require_coerce2();
   var semverGreaterThanOrEqualTo = require_gte2();
   var semverSatisfies = require_satisfies2();
@@ -36367,7 +36434,7 @@ var require_libvips = __commonJS((exports, module) => {
     }
     return false;
   };
-  var sha512 = (s) => createHash9("sha512").update(s).digest("hex");
+  var sha512 = (s) => createHash10("sha512").update(s).digest("hex");
   var yarnLocator = () => {
     try {
       const identHash = sha512(`imgsharp-libvips-${buildPlatformArch()}`);
@@ -50659,10 +50726,10 @@ var import_sharp, __dirname = "/home/runner/work/akm/akm/node_modules/@huggingfa
       if (cached) {
         return cached.text();
       }
-      const hash3 = await this._getLfsFileHash(url2);
-      if (hash3) {
-        await hashCache.put(url2, new Response(hash3));
-        return hash3;
+      const hash4 = await this._getLfsFileHash(url2);
+      if (hash4) {
+        await hashCache.put(url2, new Response(hash4));
+        return hash4;
       }
       return null;
     } catch {
@@ -68759,15 +68826,15 @@ ${this.boa_token}${this.audio_token.repeat(this._compute_audio_num_tokens(audio_
 });
 
 // src/indexer/walk/file-context.ts
-import fs45 from "node:fs";
-import path55 from "node:path";
+import fs47 from "node:fs";
+import path56 from "node:path";
 function buildFileContext(stashRoot, absPath) {
-  const relPath = toPosix(path55.relative(stashRoot, absPath));
-  const ext = path55.extname(absPath).toLowerCase();
-  const fileName = path55.basename(absPath);
-  const parentDirAbs = path55.dirname(absPath);
-  const parentDir = path55.basename(parentDirAbs);
-  const relDir = toPosix(path55.dirname(relPath));
+  const relPath = toPosix(path56.relative(stashRoot, absPath));
+  const ext = path56.extname(absPath).toLowerCase();
+  const fileName = path56.basename(absPath);
+  const parentDirAbs = path56.dirname(absPath);
+  const parentDir = path56.basename(parentDirAbs);
+  const relDir = toPosix(path56.dirname(relPath));
   const ancestorDirs = relDir === "." ? [] : relDir.split("/").filter((seg) => seg.length > 0);
   let cachedContent;
   let cachedFrontmatter;
@@ -68784,7 +68851,7 @@ function buildFileContext(stashRoot, absPath) {
     stashRoot,
     content() {
       if (cachedContent === undefined) {
-        cachedContent = fs45.readFileSync(absPath, "utf8");
+        cachedContent = fs47.readFileSync(absPath, "utf8");
       }
       return cachedContent;
     },
@@ -68799,7 +68866,7 @@ function buildFileContext(stashRoot, absPath) {
     },
     stat() {
       if (cachedStat === undefined) {
-        cachedStat = fs45.statSync(absPath);
+        cachedStat = fs47.statSync(absPath);
       }
       return cachedStat;
     }
@@ -70922,6 +70989,7 @@ function formatProposalDrainPlain(r) {
   const deferred = Array.isArray(r.deferred) ? r.deferred : [];
   const skippedByCap = Array.isArray(r.skippedByCap) ? r.skippedByCap : [];
   const staged = Array.isArray(r.staged) ? r.staged : [];
+  const failed = Array.isArray(r.failed) ? r.failed : [];
   const prefix = r.dryRun === true ? "[dry-run] " : "";
   const lines = [
     `${prefix}Drained proposal queue (strategy=${String(r.strategy ?? "?")}, policy=${policy}, applyMode=${applyMode})`,
@@ -70929,11 +70997,15 @@ function formatProposalDrainPlain(r) {
     `  rejected: ${rejected.length}`,
     `  deferred: ${deferred.length}`,
     `  skippedByCap: ${skippedByCap.length}`,
-    `  staged: ${staged.length}`
+    `  staged: ${staged.length}`,
+    `  failed: ${failed.length}`
   ];
   for (const d of deferred) {
     lines.push(`    - ${String(d.id ?? "?")} (${String(d.reason ?? "?")})`);
   }
+  for (const f of failed) {
+    lines.push(`    ! ${String(f.id ?? "?")} (${String(f.reason ?? "?")}): ${String(f.detail ?? "?")}`);
+  }
   appendLoweringNotices(lines, r);
   return lines.join(`
 `).trimEnd();
@@ -76193,12 +76265,16 @@ var httpUrl = exports_external.string().refine((v) => v.startsWith("http://") ||
 });
 var ENGINE_NAME_PATTERN = new RegExp(ENGINE_NAME_PATTERN_SOURCE);
 var ENV_REFERENCE_PATTERN = /^\$[A-Za-z_][A-Za-z0-9_]*$|^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+var SECRET_STORE_REFERENCE_PATTERN = /^secret:\/\/(.+)$/;
 var engineName = exports_external.string().max(63).regex(ENGINE_NAME_PATTERN, "names must be lowercase kebab-case and must not begin with reserved akm-");
+function isApiKeyReference(value) {
+  return ENV_REFERENCE_PATTERN.test(value) || SECRET_STORE_REFERENCE_PATTERN.test(value);
+}
 function symbolicOrWarnApiKey(label) {
   return exports_external.string().superRefine((value) => {
-    if (ENV_REFERENCE_PATTERN.test(value))
+    if (isApiKeyReference(value))
       return;
-    warnOnce(`config:literal-api-key:${label}`, `A ${label} in config.json is a literal API key, not a $VAR/\${VAR} reference; using it as configured. Prefer \`akm config set ...apiKey '$VAR'\` (with the corresponding env var set) — see docs/reference/data-and-telemetry.md.`);
+    warnOnce(`config:literal-api-key:${label}`, `A ${label} in config.json is a literal API key, not a $VAR/\${VAR}/secret:// reference; using it as configured. Prefer \`akm config set ...apiKey '$VAR'\` (with the corresponding env var set) or \`secret://<name>\` (with \`akm secret set <name> ...\`) — see docs/reference/data-and-telemetry.md.`);
   });
 }
 var chatCompletionsEndpoint = exports_external.string().superRefine((value, ctx) => {
@@ -77366,11 +77442,19 @@ function getSources(config) {
 function loadConfig() {
   return loadUserConfig();
 }
-function resolveSecret(value) {
+function resolveSecret(value, resolveFromStore) {
   if (value === undefined)
     return;
   if (typeof value !== "string")
     return value;
+  const storeRef = SECRET_STORE_REFERENCE_PATTERN.exec(value)?.[1];
+  if (storeRef !== undefined) {
+    const resolved = resolveFromStore?.(storeRef) ?? null;
+    if (resolved === null) {
+      throw new ConfigError(`Secret store reference "${value}" did not resolve to a stored value.`, "SECRET_REFERENCE_UNRESOLVED");
+    }
+    return resolved;
+  }
   if (!value.includes("$"))
     return value;
   return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, braced, bare) => {
@@ -79254,10 +79338,10 @@ function listTxnJournalsTolerant(predicate) {
 }
 
 // src/commands/proposal/repository.ts
-import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
-import fs47 from "node:fs";
+import { createHash as createHash10, randomUUID as randomUUID6 } from "node:crypto";
+import fs49 from "node:fs";
 init_dist();
-import path60 from "node:path";
+import path61 from "node:path";
 
 // src/core/adapter/adapters/agent-skills-adapter.ts
 init_frontmatter();
@@ -80162,20 +80246,41 @@ function buildWorkflowAction(ref) {
   return `Start or resume execution with \`akm workflow run ${shellQuote(ref)}\`.`;
 }
 var TYPE_PRESENTATION = {
-  skill: { label: "Skill", renderer: "skill-md", action: (ref) => `akm show ${ref} -> follow the instructions` },
+  skill: {
+    label: "Skill",
+    renderer: "skill-md",
+    action: (ref) => `akm show ${ref} -> follow the instructions`,
+    fragmentRef: false
+  },
   command: {
     label: "Command",
     renderer: "command-md",
-    action: (ref) => `akm show ${ref} -> fill placeholders and dispatch`
+    action: (ref) => `akm show ${ref} -> fill placeholders and dispatch`,
+    fragmentRef: false
+  },
+  agent: {
+    label: "Agent",
+    renderer: "agent-md",
+    action: (ref) => `akm show ${ref} -> dispatch with full prompt`,
+    fragmentRef: false
   },
-  agent: { label: "Agent", renderer: "agent-md", action: (ref) => `akm show ${ref} -> dispatch with full prompt` },
   knowledge: {
     label: "Knowledge",
     renderer: "knowledge-md",
     action: (ref) => `akm show ${ref} -> read reference material`
   },
-  workflow: { label: "Workflow", renderer: "workflow-md", action: (ref) => buildWorkflowAction(ref) },
-  script: { label: "Script", renderer: "script-source", action: (ref) => `akm show ${ref} -> execute the run command` },
+  workflow: {
+    label: "Workflow",
+    renderer: "workflow-md",
+    action: (ref) => buildWorkflowAction(ref),
+    fragmentRef: false
+  },
+  script: {
+    label: "Script",
+    renderer: "script-source",
+    action: (ref) => `akm show ${ref} -> execute the run command`,
+    fragmentRef: false
+  },
   memory: { label: "Memory", renderer: "memory-md", action: (ref) => `akm show ${ref} -> recall context` },
   env: {
     label: "Env",
@@ -80195,7 +80300,8 @@ var TYPE_PRESENTATION = {
   task: {
     label: "Task",
     renderer: "task-yaml",
-    action: (ref) => `akm show ${ref} -> inspect; akm task run <id> -> run now; edit the file + akm task sync -> unschedule`
+    action: (ref) => `akm show ${ref} -> inspect; akm task run <id> -> run now; edit the file + akm task sync -> unschedule`,
+    fragmentRef: false
   },
   session: {
     label: "Session",
@@ -80210,7 +80316,8 @@ var TYPE_PRESENTATION = {
   instruction: {
     label: "Instruction",
     renderer: "knowledge-md",
-    action: (ref) => `akm show ${ref} -> read the project instructions`
+    action: (ref) => `akm show ${ref} -> read the project instructions`,
+    fragmentRef: false
   }
 };
 var DEFAULT_PRESENTATION = { label: "Asset" };
@@ -83136,6 +83243,8 @@ function indexDocumentFromEntry(entry, base3, rendererName) {
     doc.lessonStrength = entry.lessonStrength;
   if (entry.derivedFrom !== undefined)
     doc.derivedFrom = entry.derivedFrom;
+  if (hasMarkdownFragmentContent(entry))
+    setMarkdownFragmentContent(doc, getMarkdownFragmentContent(entry));
   return doc;
 }
 function conceptIdForRecognizedType(root, filePath, type) {
@@ -92674,8 +92783,8 @@ init_warn();
 init_write_provenance();
 
 // src/indexer/index-written-assets.ts
-import fs46 from "node:fs";
-import path58 from "node:path";
+import fs48 from "node:fs";
+import path59 from "node:path";
 init_errors();
 init_paths();
 init_warn();
@@ -92686,7 +92795,7 @@ init_paths();
 init_warn();
 
 // src/storage/repositories/index-entry-schema.ts
-var CANONICAL_INDEX_DB_VERSION = 22;
+var CANONICAL_INDEX_DB_VERSION = 23;
 var CANONICAL_ENTRY_SCHEMA_FINGERPRINT = {
   tableSql: "CREATE TABLE entries ( id INTEGER PRIMARY KEY AUTOINCREMENT, item_ref TEXT NOT NULL UNIQUE, bundle_id TEXT NOT NULL, component_id TEXT NOT NULL, concept_id TEXT NOT NULL, adapter_id TEXT NOT NULL, type TEXT NOT NULL, file_path TEXT NOT NULL, content_hash TEXT, document_json TEXT NOT NULL, search_text TEXT NOT NULL, derived_from TEXT )",
   sqliteSequenceTable: true,
@@ -92836,7 +92945,12 @@ var CANONICAL_ENTRY_SCHEMA_FINGERPRINT = {
         { sequence: 1, cid: -1, name: null, descending: 0, collation: "BINARY", key: 0 }
       ]
     }
-  ]
+  ],
+  searchSurfaces: {
+    entriesFtsSql: "CREATE VIRTUAL TABLE entries_fts USING fts5( entry_id UNINDEXED, name, description, tags, hints, content, tokenize='porter unicode61' )",
+    fragmentSourceSql: "CREATE TABLE entry_fragments ( entry_id INTEGER PRIMARY KEY REFERENCES entries(id) ON DELETE CASCADE, safe_markdown TEXT NOT NULL )",
+    fragmentsFtsSql: "CREATE VIRTUAL TABLE entry_fragments_fts USING fts5( entry_id UNINDEXED, fragment_id UNINDEXED, fragment_ordinal UNINDEXED, content, tokenize='porter unicode61' )"
+  }
 };
 function sqlString(value) {
   return `'${value.replaceAll("'", "''")}'`;
@@ -92846,8 +92960,11 @@ function normalizeSchemaSql(value) {
     return null;
   return value.replace(/\s+/g, " ").trim();
 }
+function readNamedTableSql(db, name) {
+  const row = db.prepare(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ${sqlString(name)}`).get();
+  return normalizeSchemaSql(row?.sql);
+}
 function readEntrySchemaFingerprint(db) {
-  const tableRow = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'entries'").get();
   const sqliteSequenceTable = db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'sqlite_sequence'").get() != null;
   const maxId = Number(db.prepare("SELECT COALESCE(MAX(id), 0) AS maxId FROM entries").get().maxId);
   const sequenceRow = sqliteSequenceTable ? db.prepare("SELECT seq FROM sqlite_sequence WHERE name = 'entries'").get() : undefined;
@@ -92876,11 +92993,16 @@ function readEntrySchemaFingerprint(db) {
     }))
   })).sort((left, right) => left.name.localeCompare(right.name));
   return {
-    tableSql: normalizeSchemaSql(tableRow?.sql),
+    tableSql: readNamedTableSql(db, "entries"),
     sqliteSequenceTable,
     sqliteSequenceValid,
     columns,
-    indexes
+    indexes,
+    searchSurfaces: {
+      entriesFtsSql: readNamedTableSql(db, "entries_fts"),
+      fragmentSourceSql: readNamedTableSql(db, "entry_fragments"),
+      fragmentsFtsSql: readNamedTableSql(db, "entry_fragments_fts")
+    }
   };
 }
 function hasCanonicalEntrySchema(db) {
@@ -93083,20 +93205,30 @@ function openExistingDatabase(dbPath) {
   if (classifyPathAccess(resolvedPath).access === "absent") {
     throw new Error(`Index database not found at ${resolvedPath}. Run 'akm index' to build it.`);
   }
-  return openManagedDatabase({
+  const db = openManagedDatabase({
     path: resolvedPath,
-    init: (db) => {
-      loadVecExtension(db);
-      warnIfNonCanonicalIndexGeneration(db, resolvedPath);
+    init: (db2) => {
+      loadVecExtension(db2);
     },
     create: false
   });
+  try {
+    assertCanonicalIndexGeneration(db, resolvedPath);
+    return db;
+  } catch (error2) {
+    db.close();
+    throw error2;
+  }
 }
-function warnIfNonCanonicalIndexGeneration(db, resolvedPath) {
+function assertCanonicalIndexGeneration(db, resolvedPath) {
   if (isCanonicalIndexGeneration(db))
     return;
   const classification = classifyIndexGeneration(db);
-  warnOnce(`index-read-noncanonical:${resolvedPath}`, `Index database at ${resolvedPath} does not match this akm's derived schema (stored generation ` + `${classification.storedVersion ?? "unknown"}; this binary understands ${CANONICAL_INDEX_DB_VERSION}). ` + "Reading it as-is; a query that needs a table or column this generation lacks will fail on its own. " + "Run 'akm index' to rebuild it for this binary.");
+  const stored = classification.storedVersion ?? "unknown";
+  if (classification.status === "newer") {
+    throw new ConfigError(`Index database at ${resolvedPath} was built by a newer akm (stored generation ${stored}; ` + `this binary understands ${CANONICAL_INDEX_DB_VERSION}). Upgrade akm to use this index.`, "INDEX_SCHEMA_INCOMPATIBLE", "Upgrade akm to a version that understands this index generation.");
+  }
+  throw new ConfigError(`Index database at ${resolvedPath} is not usable with this akm's derived schema (stored generation ${stored}; ` + `this binary understands ${CANONICAL_INDEX_DB_VERSION}). Run 'akm index' to rebuild it.`, "INDEX_SCHEMA_INCOMPATIBLE", "Run `akm index` to rebuild the derived index from the currently materialized sources.");
 }
 function assertIndexPathReadable(resolvedPath) {
   const { access, code } = classifyPathAccess(resolvedPath);
@@ -93113,6 +93245,7 @@ import fs40 from "node:fs";
 init_asset_ref();
 init_resolve_ref();
 init_warn();
+init_metadata();
 
 // src/indexer/search/search-fields.ts
 function buildSearchFields(entry) {
@@ -93176,9 +93309,129 @@ function buildSearchText(entry) {
 // src/storage/repositories/index-entry-mapper.ts
 init_warn();
 
+// src/core/asset/markdown-fragments.ts
+init_markdown();
+import { createHash as createHash9 } from "node:crypto";
+var MARKDOWN_FRAGMENT_MAX_CHARS = 1600;
+var MARKDOWN_FRAGMENT_PREFIX = "akm-fragment-";
+function hash3(text) {
+  return createHash9("sha256").update(text).digest("hex");
+}
+function uniqueSlugs(body) {
+  const out = new Map;
+  const seen = new Set;
+  for (const heading of parseMarkdownToc(body).headings) {
+    const base3 = markdownHeadingSlug(heading.text);
+    if (!base3)
+      continue;
+    let slug = base3;
+    for (let suffix = 1;seen.has(slug); suffix++)
+      slug = `${base3}-${suffix}`;
+    seen.add(slug);
+    out.set(heading.line, slug);
+  }
+  return out;
+}
+function textOf(lines) {
+  return lines.join(`
+`).trim();
+}
+function splitPiece(piece, maxChars) {
+  if (textOf(piece.lines).length <= maxChars)
+    return [piece];
+  const pieces = [];
+  let start = 0;
+  while (start < piece.lines.length) {
+    let end = start;
+    let chars = 0;
+    while (end < piece.lines.length) {
+      const next = piece.lines[end];
+      if (end === start && next.length > maxChars)
+        break;
+      if (end > start && chars + next.length + 1 > maxChars)
+        break;
+      chars += next.length + (end > start ? 1 : 0);
+      end++;
+    }
+    if (end === start) {
+      const line = piece.lines[start];
+      let offset = 0;
+      while (offset < line.length) {
+        let cut = Math.min(offset + maxChars, line.length);
+        if (cut < line.length) {
+          const space = line.lastIndexOf(" ", cut);
+          if (space > offset + Math.floor(maxChars * 0.55))
+            cut = space;
+        }
+        pieces.push({ lines: [line.slice(offset, cut).trim()], startLine: piece.startLine + start });
+        offset = cut;
+        while (line[offset] === " ")
+          offset++;
+      }
+      start++;
+      continue;
+    }
+    let preferred = -1;
+    for (let i = start + 1;i < end; i++)
+      if (!piece.lines[i].trim())
+        preferred = i;
+    if (preferred > start)
+      end = preferred;
+    pieces.push({ lines: piece.lines.slice(start, end), startLine: piece.startLine + start });
+    start = end;
+    while (start < piece.lines.length && !piece.lines[start].trim())
+      start++;
+  }
+  return pieces.filter((candidate) => textOf(candidate.lines));
+}
+function splitMarkdownFragmentStats(body, maxChars = MARKDOWN_FRAGMENT_MAX_CHARS) {
+  const lines = body.split(/\r?\n/);
+  const headings = parseMarkdownToc(body).headings;
+  const boundaries = [1, ...headings.map((heading) => heading.line), lines.length + 1].filter((line, index, all) => index === 0 || line !== all[index - 1]).sort((left, right) => left - right);
+  const slugs = uniqueSlugs(body);
+  const pieces = [];
+  let sectionCount = 0;
+  for (let i = 0;i < boundaries.length - 1; i++) {
+    const startLine = boundaries[i];
+    const end = boundaries[i + 1] - 1;
+    const section = { lines: lines.slice(startLine - 1, end), startLine, headingSlug: slugs.get(startLine) };
+    if (textOf(section.lines)) {
+      sectionCount++;
+      pieces.push(...splitPiece(section, maxChars));
+    }
+  }
+  const piecesPerHeading = new Map;
+  for (const piece of pieces) {
+    if (piece.headingSlug)
+      piecesPerHeading.set(piece.headingSlug, (piecesPerHeading.get(piece.headingSlug) ?? 0) + 1);
+  }
+  const fragments = pieces.map((piece, ordinal) => {
+    const text = textOf(piece.lines);
+    const contentLines = piece.lines.map((line, index) => ({ line, index })).filter(({ line }) => line.trim());
+    const first = contentLines[0]?.index ?? 0;
+    const last = contentLines.at(-1)?.index ?? 0;
+    const digest = hash3(text);
+    const unsplitHeading = piece.headingSlug && piecesPerHeading.get(piece.headingSlug) === 1;
+    return {
+      fragmentId: `${MARKDOWN_FRAGMENT_PREFIX}${ordinal + 1}-${digest.slice(0, 12)}`,
+      ordinal,
+      startLine: piece.startLine + first,
+      endLine: piece.startLine + last,
+      ...unsplitHeading ? { headingSlug: piece.headingSlug } : {},
+      text,
+      hash: digest
+    };
+  });
+  return { fragments, hardSplitCount: Math.max(0, pieces.length - sectionCount) };
+}
+function splitMarkdownFragments(body, maxChars = MARKDOWN_FRAGMENT_MAX_CHARS) {
+  return splitMarkdownFragmentStats(body, maxChars).fragments;
+}
+
 // src/storage/repositories/index-fts-repository.ts
 init_warn();
 var INSERT_FTS_SQL = "INSERT INTO entries_fts (entry_id, name, description, tags, hints, content) VALUES (?, ?, ?, ?, ?, ?)";
+var INSERT_FRAGMENT_SQL = "INSERT INTO entry_fragments_fts (entry_id, fragment_id, fragment_ordinal, content) VALUES (?, ?, ?, ?)";
 var ftsMutationStatementsByDb = new WeakMap;
 function getFtsMutationStatements(db) {
   const existing = ftsMutationStatementsByDb.get(db);
@@ -93186,22 +93439,39 @@ function getFtsMutationStatements(db) {
     return existing;
   const statements = {
     deleteOne: db.prepare("DELETE FROM entries_fts WHERE entry_id = ?"),
-    insert: db.prepare(INSERT_FTS_SQL)
+    insert: db.prepare(INSERT_FTS_SQL),
+    deleteFragments: db.prepare("DELETE FROM entry_fragments_fts WHERE entry_id = ?"),
+    upsertFragmentSource: db.prepare("INSERT INTO entry_fragments (entry_id, safe_markdown) VALUES (?, ?) ON CONFLICT(entry_id) DO UPDATE SET safe_markdown = excluded.safe_markdown"),
+    deleteFragmentSource: db.prepare("DELETE FROM entry_fragments WHERE entry_id = ?"),
+    insertFragment: db.prepare(INSERT_FRAGMENT_SQL)
   };
   ftsMutationStatementsByDb.set(db, statements);
   return statements;
 }
-function replaceFtsEntry(db, entryId, entry) {
+function replaceFtsEntry(db, entryId, entry, fragmentContent) {
   const fields = buildSearchFields(entry);
   const statements = getFtsMutationStatements(db);
   statements.deleteOne.run(entryId);
   statements.insert.run(entryId, fields.name, fields.description, fields.tags, fields.hints, fields.content);
+  if (fragmentContent === undefined) {
+    return;
+  }
+  statements.deleteFragments.run(entryId);
+  statements.deleteFragmentSource.run(entryId);
+  if (!fragmentContent)
+    return;
+  statements.upsertFragmentSource.run(entryId, fragmentContent);
+  for (const fragment of splitMarkdownFragments(fragmentContent)) {
+    statements.insertFragment.run(entryId, fragment.fragmentId, fragment.ordinal, fragment.text.toLowerCase());
+  }
 }
 function deleteFtsEntries(db, entryIds) {
   for (let i = 0;i < entryIds.length; i += SQLITE_CHUNK_SIZE) {
     const chunk = entryIds.slice(i, i + SQLITE_CHUNK_SIZE);
     const placeholders = chunk.map(() => "?").join(",");
     db.prepare(`DELETE FROM entries_fts WHERE entry_id IN (${placeholders})`).run(...chunk);
+    db.prepare(`DELETE FROM entry_fragments_fts WHERE entry_id IN (${placeholders})`).run(...chunk);
+    db.prepare(`DELETE FROM entry_fragments WHERE entry_id IN (${placeholders})`).run(...chunk);
   }
 }
 
@@ -93216,7 +93486,7 @@ function upsertEntry(db, filePath, entry, searchText, provenance, contentHash) {
       throw new Error("upsertEntry: item_ref not found after upsert");
     if (previous?.id === result.id && previous.search_text !== searchText)
       deleteEntryVectors(db, result.id);
-    replaceFtsEntry(db, result.id, entry);
+    replaceFtsEntry(db, result.id, entry, hasMarkdownFragmentContent(entry) ? getMarkdownFragmentContent(entry) ?? null : undefined);
     return result.id;
   };
   return db.transaction(apply)();
@@ -93712,6 +93982,127 @@ function redactSensitiveText(text, sensitiveValues) {
 
 // src/llm/embedders/remote.ts
 init_warn();
+
+// src/sources/snapshot-fetchers/secret-seam.ts
+import fs45 from "node:fs";
+
+// src/core/env-secret-ref.ts
+import fs43 from "node:fs";
+import path54 from "node:path";
+
+// src/registry/origin-resolve.ts
+init_asset_ref();
+function resolveSourcesForOrigin(origin, allSources) {
+  if (!origin)
+    return allSources;
+  const installations = deriveInstallations(allSources);
+  return allSources.filter((_, index) => installations[index]?.id === origin);
+}
+
+// src/core/asset/asset-create.ts
+init_errors();
+function normalizeCreateSubPath(subPath) {
+  if (subPath === undefined)
+    return "";
+  const trimmed = subPath.trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (!trimmed)
+    return "";
+  if (trimmed.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new UsageError("--path must be a relative directory without '.' or '..' segments.");
+  }
+  return trimmed;
+}
+function assertFlatAssetName(name) {
+  if (name?.replace(/\\/g, "/").replace(/\.md$/i, "").includes("/")) {
+    throw new UsageError("Asset --name must be a flat name without '/'. Use --path to choose a subdirectory " + "(e.g. --path personal --name grocery-list).");
+  }
+}
+function combineCreatePath(subPath, baseName) {
+  return subPath ? `${subPath}/${baseName}` : baseName;
+}
+
+// src/core/env-secret-ref.ts
+init_asset_placement();
+init_resolve_ref();
+init_common();
+init_errors();
+function assertNotRemovedVaultRef(ref) {
+  const boundary = ref.indexOf("//");
+  const bare = boundary >= 0 ? ref.slice(boundary + 2) : ref;
+  if (/^vault[:/]/.test(bare.trim())) {
+    throw new UsageError("The `vault` asset type was removed in 0.9.0 — use `env/` (whole .env config) or `secrets/` (a single value).", "INVALID_FLAG_VALUE");
+  }
+}
+function assertNotColonRef(ref, aliases, replacement) {
+  const boundary = ref.indexOf("//");
+  const bare = (boundary >= 0 ? ref.slice(boundary + 2) : ref).trim();
+  const colon = bare.indexOf(":");
+  if (colon <= 0)
+    return;
+  const head = bare.slice(0, colon).toLowerCase();
+  if (!aliases.includes(head))
+    return;
+  const name = bare.slice(colon + 1);
+  throw new UsageError(`The \`${head}:\` ref spelling was removed in 0.9.0 — use the slash form instead: \`${replacement}${name}\`.`, "INVALID_FLAG_VALUE");
+}
+function findEnvSource(origin, type, name) {
+  const sources = resolveSourceEntries(undefined, loadConfig());
+  if (sources.length === 0) {
+    throw new UsageError("No bundles configured. Run `akm bundle create` to create your working bundle.");
+  }
+  const candidates = origin ? resolveSourcesForOrigin(origin, sources) : sources;
+  const typeDir = type === "env" ? "env" : "secrets";
+  const member = candidates.find((source) => fs43.existsSync(assetPathForName(type, path54.join(source.path, typeDir), name)));
+  if (member)
+    return member;
+  if (!origin) {
+    const fallback = candidates[0];
+    if (fallback)
+      return fallback;
+    throw new UsageError("No bundles configured. Run `akm bundle create` to create your working bundle.");
+  }
+  const named = candidates[0];
+  if (!named) {
+    throw new NotFoundError(`Source not found for origin: ${origin}`);
+  }
+  return named;
+}
+function parseSecretRef(ref) {
+  assertNotRemovedVaultRef(ref);
+  assertNotColonRef(ref, ["secret", "secrets"], "secrets/");
+  return parseRefInput(isFullRefInput(ref) ? ref : `secrets/${ref}`);
+}
+function resolveSecretPath(ref, create) {
+  const parsed = parseSecretRef(ref);
+  if (parsed.type !== "secret") {
+    throw new UsageError(`Expected a secret ref (secrets/<name>); got "${ref}".`);
+  }
+  if (create) {
+    assertFlatAssetName(parsed.name);
+    parsed.name = combineCreatePath(normalizeCreateSubPath(create.subPath), parsed.name);
+  }
+  const source = findEnvSource(parsed.origin, "secret", parsed.name);
+  const typeRoot = path54.join(source.path, "secrets");
+  const absPath = assetPathForName("secret", typeRoot, parsed.name);
+  if (!isWithin(absPath, typeRoot)) {
+    throw new UsageError(`Secret name "${parsed.name}" escapes the secrets directory.`);
+  }
+  return { name: parsed.name, absPath, source };
+}
+
+// src/sources/snapshot-fetchers/secret-seam.ts
+function resolveSecretFromStore(ref) {
+  try {
+    const { absPath } = resolveSecretPath(ref);
+    if (!fs45.existsSync(absPath))
+      return null;
+    return fs45.readFileSync(absPath, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/llm/embedders/remote.ts
 var DEFAULT_REMOTE_BATCH_SIZE = 100;
 var DEFAULT_TOKEN_BUDGET = 8000;
 function estimateTokenCount(text) {
@@ -93867,14 +94258,14 @@ class RemoteEmbedder {
   }
   buildHeaders() {
     const headers = { "Content-Type": "application/json" };
-    const resolvedKey = resolveSecret(this.config.apiKey);
+    const resolvedKey = resolveSecret(this.config.apiKey, resolveSecretFromStore);
     if (resolvedKey) {
       headers.Authorization = `Bearer ${resolvedKey}`;
     }
     return headers;
   }
   safeErrorBody(body) {
-    const resolvedKey = resolveSecret(this.config.apiKey);
+    const resolvedKey = resolveSecret(this.config.apiKey, resolveSecretFromStore);
     return redactSensitiveText(redactErrorBody(body), resolvedKey ? [resolvedKey] : []);
   }
 }
@@ -94109,8 +94500,11 @@ function publishTargetedEmbeddingMeta(db, config) {
   setMeta(db, "hasEmbeddings", ready ? "1" : "0");
 }
 
+// src/indexer/index-written-assets.ts
+init_metadata();
+
 // src/indexer/scan/drain-dir.ts
-import path57 from "node:path";
+import path58 from "node:path";
 init_common();
 init_recognition_util();
 
@@ -94119,8 +94513,8 @@ init_common();
 init_errors();
 init_recognition_util();
 init_warn();
-import fs43 from "node:fs";
-import path54 from "node:path";
+import fs46 from "node:fs";
+import path55 from "node:path";
 
 class WorkflowSourceRejectionError extends UsageError {
   sourcePaths;
@@ -94160,63 +94554,67 @@ class WorkflowSourcePathIdentityError extends WorkflowSourceRejectionError {
 function workflowNameForSourcePath(sourceRoot, adapterId, sourcePath) {
   if (adapterId !== "akm" && adapterId !== "akm-workflow")
     return;
-  const relativePath = toPosix(path54.relative(path54.resolve(sourceRoot), path54.resolve(sourcePath)));
+  const relativePath = toPosix(path55.relative(path55.resolve(sourceRoot), path55.resolve(sourcePath)));
   if (!isSafeRelativeName(relativePath))
     return;
   const ownedPath = adapterId === "akm" ? relativePath.replace(/^workflows\//, "") : relativePath;
   if (adapterId === "akm" && ownedPath === relativePath)
     return;
-  const extension = path54.posix.extname(ownedPath);
+  const extension = path55.posix.extname(ownedPath);
   if (!WORKFLOW_EXTENSIONS.includes(extension.toLowerCase()))
     return;
   return ownedPath;
 }
-function listWorkflowSourceFiles(sourceRoot, adapterId, name) {
+function resolveWorkflowSourceDomains(sourceRoot, adapterId, sourcePaths) {
   if (adapterId !== "akm" && adapterId !== "akm-workflow")
     return [];
-  const canonicalName = canonicalizeWorkflowName(normalizeName2(name));
-  if (!isSafeRelativeName(canonicalName)) {
-    throw new UsageError("Workflow ref resolves outside the bundle root.", "PATH_ESCAPE_VIOLATION");
-  }
+  const authoredRoot = path55.resolve(sourceRoot);
   let realRoot;
-  const authoredRoot = path54.resolve(sourceRoot);
   try {
-    realRoot = fs43.realpathSync(authoredRoot);
+    realRoot = fs46.realpathSync(authoredRoot);
   } catch {
     return [];
   }
-  const ownershipRoot = adapterId === "akm" ? path54.join(authoredRoot, "workflows") : authoredRoot;
-  const parent = path54.join(ownershipRoot, path54.dirname(canonicalName));
-  if (!isWithinResolved(parent, authoredRoot)) {
-    throw new UsageError("Workflow ref resolves outside the bundle root.", "PATH_ESCAPE_VIOLATION");
-  }
-  let entries;
-  try {
-    entries = fs43.readdirSync(parent, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  const basename = path54.basename(canonicalName);
-  const candidates = [];
-  for (const entry of entries) {
-    if (!entry.isFile() && !entry.isSymbolicLink())
+  const candidatesByName = new Map;
+  const seenAuthoredPaths = new Set;
+  for (const sourcePath of sourcePaths) {
+    const normalizedSourcePath = path55.resolve(sourcePath);
+    if (seenAuthoredPaths.has(normalizedSourcePath))
       continue;
-    const extension = path54.extname(entry.name);
+    seenAuthoredPaths.add(normalizedSourcePath);
+    const authoredName = workflowNameForSourcePath(authoredRoot, adapterId, normalizedSourcePath);
+    if (authoredName === undefined)
+      continue;
+    const canonicalName = canonicalizeWorkflowName(authoredName);
+    if (!isSafeRelativeName(canonicalName))
+      continue;
+    const extension = path55.extname(normalizedSourcePath);
     const lowerExtension = extension.toLowerCase();
     if (!WORKFLOW_EXTENSIONS.includes(lowerExtension))
       continue;
-    if (entry.name.slice(0, -extension.length) !== basename)
-      continue;
-    const candidatePath = path54.join(parent, entry.name);
-    candidates.push({
-      path: candidatePath,
-      relativePath: toPosix(path54.relative(authoredRoot, candidatePath)),
+    const candidate = {
+      path: normalizedSourcePath,
+      relativePath: toPosix(path55.relative(authoredRoot, normalizedSourcePath)),
       lowerExtension,
-      extensionlessStem: entry.name.slice(0, -extension.length)
+      extensionlessStem: path55.basename(normalizedSourcePath).slice(0, -extension.length)
+    };
+    const domain = candidatesByName.get(canonicalName) ?? [];
+    domain.push(candidate);
+    candidatesByName.set(canonicalName, domain);
+  }
+  const resolutions = [];
+  for (const canonicalName of [...candidatesByName.keys()].sort(compareCodePoints)) {
+    const candidates = candidatesByName.get(canonicalName) ?? [];
+    candidates.sort((left, right) => compareCodePoints(left.relativePath, right.relativePath));
+    const sources = inspectWorkflowSourceDomain(candidates, canonicalName, realRoot);
+    const sourcePaths2 = candidates.map((candidate) => candidate.relativePath);
+    resolutions.push({
+      canonicalName,
+      sourcePaths: sourcePaths2,
+      source: pickWorkflowSource(adapterId, canonicalName, sources)
     });
   }
-  candidates.sort((left, right) => compareCodePoints(left.relativePath, right.relativePath));
-  return inspectWorkflowSourceDomain(candidates, canonicalName, realRoot);
+  return resolutions;
 }
 function inspectWorkflowSourceDomain(candidates, canonicalName, realRoot) {
   const sources = [];
@@ -94245,7 +94643,7 @@ function inspectWorkflowSourceCandidate(candidate, canonicalName, realRoot) {
   const issues = [];
   let authoredStat;
   try {
-    authoredStat = fs43.lstatSync(candidate.path);
+    authoredStat = fs46.lstatSync(candidate.path);
   } catch {
     issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     return { issues };
@@ -94257,21 +94655,21 @@ function inspectWorkflowSourceCandidate(candidate, canonicalName, realRoot) {
   }
   let realPath;
   try {
-    realPath = fs43.realpathSync(candidate.path);
+    realPath = fs46.realpathSync(candidate.path);
   } catch {
     issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     return { issues };
   }
-  const targetPath = toPosix(path54.relative(realRoot, realPath));
+  const targetPath = toPosix(path55.relative(realRoot, realPath));
   const contained2 = isWithinResolved(realPath, realRoot);
   if (!contained2)
     issues.push(new WorkflowSourcePathIdentityError(candidate.relativePath, targetPath));
-  if (isLink && path54.extname(realPath).toLowerCase() !== candidate.lowerExtension) {
+  if (isLink && path55.extname(realPath).toLowerCase() !== candidate.lowerExtension) {
     issues.push(new WorkflowSourceLinkIdentityError(candidate.relativePath, targetPath));
   }
   if (contained2) {
     try {
-      if (!fs43.statSync(realPath).isFile())
+      if (!fs46.statSync(realPath).isFile())
         issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
     } catch {
       issues.push(new WorkflowSourceLinkResolutionError(candidate.relativePath));
@@ -94290,20 +94688,12 @@ function inspectWorkflowSourceCandidate(candidate, canonicalName, realRoot) {
     }
   };
 }
-function resolveUniqueWorkflowSource(sourceRoot, adapterId, name) {
-  const sources = listWorkflowSourceFiles(sourceRoot, adapterId, name);
-  const canonicalName = sources[0]?.canonicalName ?? canonicalizeWorkflowName(normalizeName2(name));
-  return pickWorkflowSource(adapterId, canonicalName, sources);
-}
-function normalizeName2(name) {
-  return name.replaceAll("\\", "/");
-}
 function isSafeRelativeName(name) {
-  return name.length > 0 && !path54.posix.isAbsolute(name) && name !== ".." && !name.startsWith("../") && path54.posix.normalize(name) === name;
+  return name.length > 0 && !path55.posix.isAbsolute(name) && name !== ".." && !name.startsWith("../") && path55.posix.normalize(name) === name;
 }
 function isWithinResolved(candidate, root) {
-  const relative = path54.relative(root, path54.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path54.isAbsolute(relative);
+  const relative = path55.relative(root, path55.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path55.isAbsolute(relative);
 }
 
 // src/indexer/scan/drain-dir.ts
@@ -94312,13 +94702,14 @@ init_metadata();
 init_file_context();
 
 // src/indexer/scan/doc-to-entry.ts
-import path56 from "node:path";
+init_metadata();
+import path57 from "node:path";
 function indexDocumentToStashEntry(doc) {
   const dj = doc.documentJson ?? {};
   const entry = {
     name: doc.name,
     type: doc.type,
-    filename: path56.basename(doc.path ?? "")
+    filename: path57.basename(doc.path ?? "")
   };
   if (doc.description !== undefined)
     entry.description = doc.description;
@@ -94328,6 +94719,8 @@ function indexDocumentToStashEntry(doc) {
     entry.content = doc.content;
   if (doc.contentTruncated !== undefined)
     entry.contentTruncated = doc.contentTruncated;
+  if (hasMarkdownFragmentContent(doc))
+    setMarkdownFragmentContent(entry, getMarkdownFragmentContent(doc));
   if (doc.ownsPresentation !== undefined)
     entry.ownsPresentation = doc.ownsPresentation;
   if (doc.updated !== undefined)
@@ -94421,31 +94814,28 @@ function drainDirDocuments(adapter, component, fileContexts) {
   const conceptIdByFile = new Map;
   const rejectedPaths = new Set;
   const rejectedConceptIds = new Set;
-  const workflowLookups = new Map;
-  for (const file of fileContexts) {
+  const workflowOwnerPathByCanonicalName = new Map(resolveWorkflowSourceDomains(component.root, adapter.id, fileContexts.map((file) => file.absPath)).filter((resolution) => resolution.source !== undefined).map((resolution) => [resolution.canonicalName, path58.resolve(resolution.source.path)]));
+  const invalidWorkflowOwnerNames = new Set;
+  const orderedFileContexts = [...fileContexts].sort((left, right) => {
+    const leftName = workflowNameForSourcePath(component.root, adapter.id, left.absPath);
+    const rightName = workflowNameForSourcePath(component.root, adapter.id, right.absPath);
+    const leftOwner = leftName !== undefined && workflowOwnerPathByCanonicalName.get(canonicalizeWorkflowName(leftName)) === path58.resolve(left.absPath);
+    const rightOwner = rightName !== undefined && workflowOwnerPathByCanonicalName.get(canonicalizeWorkflowName(rightName)) === path58.resolve(right.absPath);
+    if (leftOwner !== rightOwner)
+      return leftOwner ? -1 : 1;
+    return compareCodePoints(left.absPath, right.absPath);
+  });
+  for (const file of orderedFileContexts) {
+    if (rejectedPaths.has(file.absPath))
+      continue;
     const workflowName = workflowNameForSourcePath(component.root, adapter.id, file.absPath);
     if (workflowName !== undefined) {
       const canonicalName = canonicalizeWorkflowName(workflowName);
-      if (!workflowLookups.has(canonicalName))
-        workflowLookups.set(canonicalName, workflowName);
-    }
-  }
-  for (const [canonicalName, workflowName] of [...workflowLookups].sort(([left], [right]) => compareCodePoints(left, right))) {
-    try {
-      resolveUniqueWorkflowSource(component.root, adapter.id, workflowName);
-    } catch (error2) {
-      if (!(error2 instanceof WorkflowSourceRejectionError))
-        throw error2;
-      rejectedConceptIds.add(adapter.id === "akm" ? `workflows/${canonicalName}` : canonicalName);
-      for (const relativePath of error2.sourcePaths) {
-        rejectedPaths.add(path57.join(component.root, relativePath));
+      const ownerPath = workflowOwnerPathByCanonicalName.get(canonicalName);
+      if (ownerPath !== undefined && ownerPath !== path58.resolve(file.absPath) && !invalidWorkflowOwnerNames.has(canonicalName)) {
+        continue;
       }
-      warnings.push(error2.message);
     }
-  }
-  for (const file of fileContexts) {
-    if (rejectedPaths.has(file.absPath))
-      continue;
     const doc = adapter.recognize(component, file);
     if (doc === null)
       continue;
@@ -94457,6 +94847,8 @@ function drainDirDocuments(adapter, component, fileContexts) {
     const dropWarning = handleWorkflowDoc(doc, file, component.root);
     if (dropWarning !== null) {
       warnings.push(dropWarning);
+      if (workflowName !== undefined)
+        invalidWorkflowOwnerNames.add(canonicalizeWorkflowName(workflowName));
       continue;
     }
     if (doc.hash !== undefined)
@@ -94500,7 +94892,7 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
       if (isPathAbsent(dbPath))
         return true;
       const files = filePaths.filter((f) => {
-        const rel = path58.relative(stashDir, f);
+        const rel = path59.relative(stashDir, f);
         return !rel.split(/[\\/]+/).some((segment) => segment.startsWith("."));
       });
       if (files.length === 0)
@@ -94514,10 +94906,10 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
       const unindexable = new Set;
       const rejectedConceptIds = new Set;
       for (const file of files) {
-        if (!fs46.existsSync(file)) {
+        if (!fs48.existsSync(file)) {
           let authoredDanglingSymlink = false;
           try {
-            authoredDanglingSymlink = fs46.lstatSync(file).isSymbolicLink();
+            authoredDanglingSymlink = fs48.lstatSync(file).isSymbolicLink();
           } catch {}
           if (!authoredDanglingSymlink) {
             unindexable.add(file);
@@ -94568,7 +94960,10 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
           for (const { file, entry, conceptId, contentHash } of pairs) {
             let entryWithSize = entry;
             try {
-              entryWithSize = { ...entry, fileSize: fs46.statSync(file).size };
+              entryWithSize = { ...entry, fileSize: fs48.statSync(file).size };
+              if (hasMarkdownFragmentContent(entry)) {
+                setMarkdownFragmentContent(entryWithSize, getMarkdownFragmentContent(entry));
+              }
             } catch {}
             const provenance = deriveEntryProvenance({ bundleId: component.id, componentId: component.id, adapterId: component.adapter }, entry.type, entry.name, conceptId);
             const supersededIds = db.prepare("SELECT id FROM entries WHERE file_path = ? AND item_ref <> ?").all(file, provenance.itemRef);
@@ -94601,7 +94996,7 @@ async function indexWrittenAssets(stashDir, filePaths, options = {}) {
 init_asset_placement();
 init_asset_ref();
 init_warn();
-import path59 from "node:path";
+import path60 from "node:path";
 function changesToStored(changes) {
   return changes.map((c, i) => ({
     path: c.path,
@@ -94654,10 +95049,10 @@ function currentProposalTarget(value) {
   if (typeof value !== "object" || value === null)
     throw new Error("Proposal metadata has an invalid proposedTarget.");
   const target = value;
-  if (typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path59.isAbsolute(target.root)) {
+  if (typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path60.isAbsolute(target.root)) {
     throw new Error("Proposal metadata has an invalid proposedTarget.");
   }
-  return { source: target.source, root: path59.resolve(target.root) };
+  return { source: target.source, root: path60.resolve(target.root) };
 }
 function invalidPresentField(name) {
   throw new Error(`Proposal metadata has an invalid ${name}.`);
@@ -94697,7 +95092,7 @@ function validatePresentMetadata(meta) {
   }
   if (Object.hasOwn(meta, "acceptedTarget")) {
     const target = meta.acceptedTarget;
-    if (typeof target !== "object" || target === null || typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path59.isAbsolute(target.root) || typeof target.path !== "string" || !path59.isAbsolute(target.path) || typeof target.contentHash !== "string") {
+    if (typeof target !== "object" || target === null || typeof target.source !== "string" || !isBundleSlug(target.source) || typeof target.root !== "string" || !path60.isAbsolute(target.root) || typeof target.path !== "string" || !path60.isAbsolute(target.path) || typeof target.contentHash !== "string") {
       invalidPresentField("acceptedTarget");
     }
   }
@@ -95428,15 +95823,15 @@ var PROPOSAL_TXN_PHASES = [
   "committed"
 ];
 function proposalHash(content) {
-  return createHash9("sha256").update(content).digest("hex");
+  return createHash10("sha256").update(content).digest("hex");
 }
 function proposalFileHash(filePath) {
-  return proposalHash(fs47.readFileSync(filePath));
+  return proposalHash(fs49.readFileSync(filePath));
 }
 function sameProposalFile(left, right) {
   try {
-    const leftStat = fs47.statSync(left);
-    const rightStat = fs47.statSync(right);
+    const leftStat = fs49.statSync(left);
+    const rightStat = fs49.statSync(right);
     return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
   } catch {
     return false;
@@ -95445,20 +95840,20 @@ function sameProposalFile(left, right) {
 function cleanupProposalPublication(p) {
   for (const filePath of [p.publishPath, p.displacedPath]) {
     try {
-      fs47.rmSync(filePath, { force: true });
+      fs49.rmSync(filePath, { force: true });
     } catch (error2) {
       warn(`[proposals] transaction publication cleanup failed at ${filePath}: ${error2 instanceof Error ? error2.message : String(error2)}`);
     }
   }
-  fsyncTxnDir(path60.dirname(p.assetPath));
+  fsyncTxnDir(path61.dirname(p.assetPath));
 }
 function rollbackPreparedProposalTransaction(txn) {
   const p = txn.journal.payload;
-  const currentHash = fs47.existsSync(p.assetPath) ? proposalFileHash(p.assetPath) : null;
-  if (!fs47.existsSync(p.displacedPath)) {
+  const currentHash = fs49.existsSync(p.assetPath) ? proposalFileHash(p.assetPath) : null;
+  if (!fs49.existsSync(p.displacedPath)) {
     if (p.originalHash === null) {
       if (currentHash === p.publishedHash && sameProposalFile(p.assetPath, p.publishPath)) {
-        fs47.unlinkSync(p.assetPath);
+        fs49.unlinkSync(p.assetPath);
         recordWrittenPath(p.assetPath);
       } else if (currentHash !== null) {
         throw new Error(`Cannot roll back proposal transaction: target was created externally.`);
@@ -95470,30 +95865,30 @@ function rollbackPreparedProposalTransaction(txn) {
     return;
   }
   if (currentHash === p.publishedHash) {
-    fs47.unlinkSync(p.assetPath);
+    fs49.unlinkSync(p.assetPath);
     recordWrittenPath(p.assetPath);
   } else if (currentHash !== null && currentHash !== p.originalHash) {
     throw new Error(`Cannot roll back proposal transaction: ${p.assetPath} diverged.`);
   }
-  if (fs47.existsSync(p.displacedPath)) {
-    if (fs47.existsSync(p.assetPath)) {
+  if (fs49.existsSync(p.displacedPath)) {
+    if (fs49.existsSync(p.assetPath)) {
       throw new Error(`Cannot restore proposal backup: ${p.assetPath} is occupied.`);
     }
-    fs47.linkSync(p.displacedPath, p.assetPath);
+    fs49.linkSync(p.displacedPath, p.assetPath);
     recordWrittenPath(p.assetPath);
   }
   cleanupProposalPublication(p);
 }
 function validatePublishedProposal(p) {
-  if (!fs47.existsSync(p.assetPath) || proposalFileHash(p.assetPath) !== p.publishedHash) {
+  if (!fs49.existsSync(p.assetPath) || proposalFileHash(p.assetPath) !== p.publishedHash) {
     throw new Error(`Cannot recover proposal ${p.proposalId}: published asset diverged.`);
   }
 }
 function persistProposalTransactionState(txn, proposal, ctx) {
   const p = txn.journal.payload;
   const decidedAt = txn.journal.decidedAt;
-  const backupContent = p.backupPath ? fs47.readFileSync(p.backupPath, "utf8") : undefined;
-  const publishedContent = fs47.readFileSync(p.contentPath, "utf8");
+  const backupContent = p.backupPath ? fs49.readFileSync(p.backupPath, "utf8") : undefined;
+  const publishedContent = fs49.readFileSync(p.contentPath, "utf8");
   return withProposalsDb(p.stashDir, ctx, (db) => withImmediateTransaction(db, () => {
     const current = requireProposal(db, p.stashDir, p.proposalId);
     if (p.operation === "accept") {
@@ -95511,7 +95906,7 @@ function persistProposalTransactionState(txn, proposal, ctx) {
         payload: { ...proposal.payload, content: publishedContent },
         changes: [
           {
-            path: path60.relative(txn.journal.root, p.assetPath),
+            path: path61.relative(txn.journal.root, p.assetPath),
             op: p.originalHash === null ? "create" : "update",
             after: publishedContent
           }
@@ -95582,7 +95977,7 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
   cleanupProposalPublication(p);
   if (txn.journal.phase === "asset-published") {
     const commitRoot = target.source.repoPath ?? target.source.path;
-    const commitPath = path60.relative(commitRoot, p.assetPath).replaceAll(path60.sep, "/");
+    const commitPath = path61.relative(commitRoot, p.assetPath).replaceAll(path61.sep, "/");
     publishWriteTargetTransaction(target, p.gitPublication, {
       transactionId: txn.journal.transactionId,
       message: `${p.operation === "accept" ? "Update" : "Revert"} ${p.ref}`,
@@ -95619,8 +96014,8 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
 function fenceProposalTxnJournal(journal, txnDir, root) {
   const p = journal.payload;
   const refIdentity = proposalRefIdentity(p.ref);
-  if (!["accept", "revert"].includes(p.operation) || !p.targetSource || !p.targetKind || refIdentity?.bundle === undefined || !isWithin(p.assetPath, root) || ![p.contentPath, p.backupPath].filter((candidate) => candidate !== null).every((candidate) => isWithin(candidate, txnDir)) || ![p.publishPath, p.displacedPath].every((candidate) => isWithin(candidate, root) && path60.dirname(candidate) === path60.dirname(p.assetPath))) {
-    throw new Error(`Refusing unsafe proposal transaction journal at ${path60.join(txnDir, "journal.json")}.`);
+  if (!["accept", "revert"].includes(p.operation) || !p.targetSource || !p.targetKind || refIdentity?.bundle === undefined || !isWithin(p.assetPath, root) || ![p.contentPath, p.backupPath].filter((candidate) => candidate !== null).every((candidate) => isWithin(candidate, txnDir)) || ![p.publishPath, p.displacedPath].every((candidate) => isWithin(candidate, root) && path61.dirname(candidate) === path61.dirname(p.assetPath))) {
+    throw new Error(`Refusing unsafe proposal transaction journal at ${path61.join(txnDir, "journal.json")}.`);
   }
 }
 function resolveProposalRecoveryTarget(config, journal) {
@@ -95720,8 +96115,8 @@ async function recoverStaleTxns(stashDir) {
 }
 
 // scripts/akm-migrate/migrate/writer-relocation.ts
-import fs48 from "node:fs";
-import path61 from "node:path";
+import fs50 from "node:fs";
+import path62 from "node:path";
 init_paths();
 function relocationSpecs(stashDir) {
   return [
@@ -95741,7 +96136,7 @@ function mutexSiblingName(lockName) {
 function fileCountIfExists(dir) {
   let entries;
   try {
-    entries = fs48.readdirSync(dir, { withFileTypes: true });
+    entries = fs50.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -95749,7 +96144,7 @@ function fileCountIfExists(dir) {
 }
 function statFileIfExists(filePath) {
   try {
-    const stat = fs48.statSync(filePath);
+    const stat = fs50.statSync(filePath);
     return stat.isFile() ? stat : undefined;
   } catch {
     return;
@@ -95759,8 +96154,8 @@ function classifyLockArtifacts(akmDir) {
   const removable = [];
   const skipped = [];
   for (const lockName of LOCK_NAMES) {
-    const lockPath = path61.join(akmDir, lockName);
-    const mutexPath = path61.join(akmDir, mutexSiblingName(lockName));
+    const lockPath = path62.join(akmDir, lockName);
+    const mutexPath = path62.join(akmDir, mutexSiblingName(lockName));
     const lockStat = statFileIfExists(lockPath);
     const mutexStat = statFileIfExists(mutexPath);
     if (!lockStat) {
@@ -95786,11 +96181,11 @@ function classifyLockArtifacts(akmDir) {
   return { removable, skipped };
 }
 function findWriterRelocationEntries(stashDir) {
-  const akmDir = path61.join(stashDir, ".akm");
+  const akmDir = path62.join(stashDir, ".akm");
   const directories = [];
   for (const spec of relocationSpecs(stashDir)) {
     const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
-    const oldPath = path61.join(akmDir, ...relativeParts);
+    const oldPath = path62.join(akmDir, ...relativeParts);
     const fileCount = fileCountIfExists(oldPath);
     if (fileCount === undefined || fileCount === 0)
       continue;
@@ -95801,36 +96196,36 @@ function findWriterRelocationEntries(stashDir) {
 }
 function moveFile(oldFilePath, newFilePath) {
   try {
-    fs48.renameSync(oldFilePath, newFilePath);
+    fs50.renameSync(oldFilePath, newFilePath);
   } catch (error2) {
     if (error2.code !== "EXDEV")
       throw error2;
-    fs48.copyFileSync(oldFilePath, newFilePath);
-    fs48.rmSync(oldFilePath, { force: true });
+    fs50.copyFileSync(oldFilePath, newFilePath);
+    fs50.rmSync(oldFilePath, { force: true });
   }
 }
 function moveDirectoryContents(entry) {
   const errors3 = [];
   let moved = 0;
-  fs48.mkdirSync(entry.newPath, { recursive: true });
+  fs50.mkdirSync(entry.newPath, { recursive: true });
   let names;
   try {
-    names = fs48.readdirSync(entry.oldPath).sort();
+    names = fs50.readdirSync(entry.oldPath).sort();
   } catch {
     return { key: entry.key, oldPath: entry.oldPath, newPath: entry.newPath, moved: 0, errors: [] };
   }
   for (const name of names) {
-    const oldFilePath = path61.join(entry.oldPath, name);
-    const newFilePath = path61.join(entry.newPath, name);
+    const oldFilePath = path62.join(entry.oldPath, name);
+    const newFilePath = path62.join(entry.newPath, name);
     let oldStat;
     try {
-      oldStat = fs48.lstatSync(oldFilePath);
+      oldStat = fs50.lstatSync(oldFilePath);
     } catch {
       continue;
     }
     if (!oldStat.isFile())
       continue;
-    if (fs48.existsSync(newFilePath))
+    if (fs50.existsSync(newFilePath))
       continue;
     try {
       moveFile(oldFilePath, newFilePath);
@@ -95843,13 +96238,13 @@ function moveDirectoryContents(entry) {
 }
 function removeIfEmptyDir(dir) {
   try {
-    if (fs48.readdirSync(dir).length === 0)
-      fs48.rmdirSync(dir);
+    if (fs50.readdirSync(dir).length === 0)
+      fs50.rmdirSync(dir);
   } catch {}
 }
 function removeLockArtifact(entry) {
   try {
-    fs48.rmSync(entry.path, { force: true });
+    fs50.rmSync(entry.path, { force: true });
     return { path: entry.path, removed: true };
   } catch (error2) {
     return { path: entry.path, removed: false, error: error2 instanceof Error ? error2.message : String(error2) };
@@ -95861,36 +96256,36 @@ function applyWriterRelocation(stashDir) {
   const lockResults = lockArtifacts.map(removeLockArtifact);
   for (const spec of relocationSpecs(stashDir)) {
     const relativeParts = Array.isArray(spec.oldRelative) ? spec.oldRelative : [spec.oldRelative];
-    removeIfEmptyDir(path61.join(stashDir, ".akm", ...relativeParts));
+    removeIfEmptyDir(path62.join(stashDir, ".akm", ...relativeParts));
   }
   return { directories: directoryResults, lockArtifacts: lockResults, skippedLocks };
 }
 
 // scripts/akm-migrate/task-migrate.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import fs53 from "node:fs";
+import fs56 from "node:fs";
 import os5 from "node:os";
-import path64 from "node:path";
+import path65 from "node:path";
 init_errors();
 init_paths();
 
 // scripts/akm-migrate/migrate/task-files-to-v3.ts
 init_errors();
 import crypto6 from "node:crypto";
-import fs50 from "node:fs";
-import path62 from "node:path";
+import fs53 from "node:fs";
+import path63 from "node:path";
 
 // scripts/akm-migrate/migrate/durable-fs.ts
-import fs49 from "node:fs";
+import fs51 from "node:fs";
 function fsyncDirectoryPortable(directory) {
   if (process.platform === "win32")
     return;
   try {
-    const fd = fs49.openSync(directory, "r");
+    const fd = fs51.openSync(directory, "r");
     try {
-      fs49.fsyncSync(fd);
+      fs51.fsyncSync(fd);
     } finally {
-      fs49.closeSync(fd);
+      fs51.closeSync(fd);
     }
   } catch (cause) {
     const code = cause.code;
@@ -95904,25 +96299,25 @@ function migrationError(detail) {
   return new ConfigError(`Task migration to v3 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained2(root, candidate) {
-  const relative = path62.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
+  const relative = path63.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
 }
 function realDirectory(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs53.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError(`${filePath} must be a real directory.`);
-  return fs50.realpathSync(filePath);
+  return fs53.realpathSync(filePath);
 }
 function snapshot(filePath) {
-  const stat = fs50.lstatSync(filePath);
+  const stat = fs53.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError(`${filePath} must be a real file.`);
-  const bytes = fs50.readFileSync(filePath);
+  const bytes = fs53.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable(filePath) {
   try {
-    fs50.accessSync(filePath, fs50.constants.W_OK);
+    fs53.accessSync(filePath, fs53.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -95935,12 +96330,12 @@ function walkTasks(root, tasksDir, out) {
     throw migrationError(`${root.root} resolves outside bundle ${root.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs50.realpathSync(directory);
+    const physicalDirectory = fs53.realpathSync(directory);
     if (!contained2(physicalRoot, physicalDirectory)) {
       throw migrationError(`${directory} resolves outside bundle ${root.bundleId}.`);
     }
-    for (const entry of fs50.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path62.join(directory, entry.name);
+    for (const entry of fs53.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path63.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -95950,7 +96345,7 @@ function walkTasks(root, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot(candidate);
-      const parent = path62.dirname(candidate);
+      const parent = path63.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -95966,9 +96361,9 @@ function walkTasks(root, tasksDir, out) {
 function inspectTaskToV3Files(roots) {
   const files = [];
   for (const root of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root.layout === "akm-task" ? root.root : path62.join(root.root, "tasks");
+    const tasksDir = root.layout === "akm-task" ? root.root : path63.join(root.root, "tasks");
     try {
-      const stat = fs50.lstatSync(tasksDir);
+      const stat = fs53.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -95983,33 +96378,33 @@ function inspectTaskToV3Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath(filePath) {
-  return crypto6.createHash("sha256").update(path62.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto6.createHash("sha256").update(path63.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPath(backupRoot, filePath) {
-  return path62.join(backupRoot, "files", `${hashPath(filePath)}-${path62.basename(filePath)}`);
+  return path63.join(backupRoot, "files", `${hashPath(filePath)}-${path63.basename(filePath)}`);
 }
 function writeDurable(filePath, bytes, mode, exclusive = false) {
-  fs50.mkdirSync(path62.dirname(filePath), { recursive: true });
+  fs53.mkdirSync(path63.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs50.openSync(filePath, flags, mode);
+  const fd = fs53.openSync(filePath, flags, mode);
   try {
-    fs50.writeFileSync(fd, bytes);
-    fs50.fsyncSync(fd);
+    fs53.writeFileSync(fd, bytes);
+    fs53.fsyncSync(fd);
   } finally {
-    fs50.closeSync(fd);
+    fs53.closeSync(fd);
   }
-  fs50.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path62.dirname(filePath));
+  fs53.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path63.dirname(filePath));
 }
 function replaceAtomically(filePath, bytes, mode) {
-  const temporary = path62.join(path62.dirname(filePath), `.${path62.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
+  const temporary = path63.join(path63.dirname(filePath), `.${path63.basename(filePath)}.migrate-${crypto6.randomUUID()}`);
   try {
     writeDurable(temporary, bytes, mode, true);
-    fs50.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path62.dirname(filePath));
+    fs53.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path63.dirname(filePath));
   } finally {
     try {
-      fs50.unlinkSync(temporary);
+      fs53.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -96048,7 +96443,7 @@ function applyTaskToV3MigrationPlan(plan, options) {
       const current = snapshot(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically(change.filePath, fs50.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically(change.filePath, fs53.readFileSync(taskMigrationBackupPath(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -96058,31 +96453,31 @@ function applyTaskToV3MigrationPlan(plan, options) {
 // scripts/akm-migrate/migrate/task-files-to-v4.ts
 init_errors();
 import crypto7 from "node:crypto";
-import fs51 from "node:fs";
-import path63 from "node:path";
+import fs55 from "node:fs";
+import path64 from "node:path";
 function migrationError2(detail) {
   return new ConfigError(`Task migration to v4 failed: ${detail}`, "INVALID_CONFIG_FILE");
 }
 function contained3(root, candidate) {
-  const relative = path63.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
+  const relative = path64.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path64.isAbsolute(relative);
 }
 function realDirectory2(filePath) {
-  const stat = fs51.lstatSync(filePath);
+  const stat = fs55.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw migrationError2(`${filePath} must be a real directory.`);
-  return fs51.realpathSync(filePath);
+  return fs55.realpathSync(filePath);
 }
 function snapshot2(filePath) {
-  const stat = fs51.lstatSync(filePath);
+  const stat = fs55.lstatSync(filePath);
   if (stat.isSymbolicLink() || !stat.isFile())
     throw migrationError2(`${filePath} must be a real file.`);
-  const bytes = fs51.readFileSync(filePath);
+  const bytes = fs55.readFileSync(filePath);
   return Object.freeze({ bytes, mode: stat.mode & 511 });
 }
 function writable2(filePath) {
   try {
-    fs51.accessSync(filePath, fs51.constants.W_OK);
+    fs55.accessSync(filePath, fs55.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -96095,12 +96490,12 @@ function walkTasks2(root, tasksDir, out) {
     throw migrationError2(`${root.root} resolves outside bundle ${root.bundleId}.`);
   }
   const visit2 = (directory) => {
-    const physicalDirectory = fs51.realpathSync(directory);
+    const physicalDirectory = fs55.realpathSync(directory);
     if (!contained3(physicalRoot, physicalDirectory)) {
       throw migrationError2(`${directory} resolves outside bundle ${root.bundleId}.`);
     }
-    for (const entry of fs51.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const candidate = path63.join(directory, entry.name);
+    for (const entry of fs55.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const candidate = path64.join(directory, entry.name);
       if (entry.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${candidate}.`);
       if (entry.isDirectory()) {
@@ -96110,7 +96505,7 @@ function walkTasks2(root, tasksDir, out) {
       if (!entry.isFile() || !entry.name.endsWith(".yml"))
         continue;
       const current = snapshot2(candidate);
-      const parent = path63.dirname(candidate);
+      const parent = path64.dirname(candidate);
       out.push({
         filePath: candidate,
         bytes: current.bytes,
@@ -96126,9 +96521,9 @@ function walkTasks2(root, tasksDir, out) {
 function inspectTaskToV4Files(roots) {
   const files = [];
   for (const root of [...roots].sort((a, b) => a.bundleId.localeCompare(b.bundleId))) {
-    const tasksDir = root.layout === "akm-task" ? root.root : path63.join(root.root, "tasks");
+    const tasksDir = root.layout === "akm-task" ? root.root : path64.join(root.root, "tasks");
     try {
-      const stat = fs51.lstatSync(tasksDir);
+      const stat = fs55.lstatSync(tasksDir);
       if (stat.isSymbolicLink())
         throw migrationError2(`task migration does not follow symbolic link ${tasksDir}.`);
       if (!stat.isDirectory())
@@ -96143,33 +96538,33 @@ function inspectTaskToV4Files(roots) {
   return files.sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 function hashPath2(filePath) {
-  return crypto7.createHash("sha256").update(path63.resolve(filePath)).digest("hex").slice(0, 16);
+  return crypto7.createHash("sha256").update(path64.resolve(filePath)).digest("hex").slice(0, 16);
 }
 function taskMigrationBackupPathV4(backupRoot, filePath) {
-  return path63.join(backupRoot, "files", `${hashPath2(filePath)}-${path63.basename(filePath)}`);
+  return path64.join(backupRoot, "files", `${hashPath2(filePath)}-${path64.basename(filePath)}`);
 }
 function writeDurable2(filePath, bytes, mode, exclusive = false) {
-  fs51.mkdirSync(path63.dirname(filePath), { recursive: true });
+  fs55.mkdirSync(path64.dirname(filePath), { recursive: true });
   const flags = exclusive ? "wx" : "w";
-  const fd = fs51.openSync(filePath, flags, mode);
+  const fd = fs55.openSync(filePath, flags, mode);
   try {
-    fs51.writeFileSync(fd, bytes);
-    fs51.fsyncSync(fd);
+    fs55.writeFileSync(fd, bytes);
+    fs55.fsyncSync(fd);
   } finally {
-    fs51.closeSync(fd);
+    fs55.closeSync(fd);
   }
-  fs51.chmodSync(filePath, mode);
-  fsyncDirectoryPortable(path63.dirname(filePath));
+  fs55.chmodSync(filePath, mode);
+  fsyncDirectoryPortable(path64.dirname(filePath));
 }
 function replaceAtomically2(filePath, bytes, mode) {
-  const temporary = path63.join(path63.dirname(filePath), `.${path63.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
+  const temporary = path64.join(path64.dirname(filePath), `.${path64.basename(filePath)}.migrate-${crypto7.randomUUID()}`);
   try {
     writeDurable2(temporary, bytes, mode, true);
-    fs51.renameSync(temporary, filePath);
-    fsyncDirectoryPortable(path63.dirname(filePath));
+    fs55.renameSync(temporary, filePath);
+    fsyncDirectoryPortable(path64.dirname(filePath));
   } finally {
     try {
-      fs51.unlinkSync(temporary);
+      fs55.unlinkSync(temporary);
     } catch (cause) {
       if (cause.code !== "ENOENT")
         throw cause;
@@ -96208,7 +96603,7 @@ function applyTaskToV4MigrationPlan(plan, options) {
       const current = snapshot2(change.filePath);
       if (!current.bytes.equals(change.after))
         continue;
-      replaceAtomically2(change.filePath, fs51.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
+      replaceAtomically2(change.filePath, fs55.readFileSync(taskMigrationBackupPathV4(options.backupRoot, change.filePath)), change.mode);
     }
     throw cause;
   }
@@ -96220,12 +96615,12 @@ function expandTilde(value) {
   if (value === "~")
     return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path64.join(os5.homedir(), value.slice(2));
+    return path65.join(os5.homedir(), value.slice(2));
   return value;
 }
 function existingDirectory(target) {
   try {
-    return fs53.statSync(target).isDirectory();
+    return fs56.statSync(target).isDirectory();
   } catch (cause) {
     if (cause.code === "ENOENT")
       return false;
@@ -96246,21 +96641,21 @@ function taskRoots(config, resolutionBase = process.cwd()) {
     const source = sources.get(bundleId);
     if (!source)
       continue;
-    const configuredRoot = source.type === "filesystem" && source.path ? path64.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
+    const configuredRoot = source.type === "filesystem" && source.path ? path65.resolve(resolutionBase, expandTilde(source.path)) : lockContentRootFor(bundleId, source.type);
     if (!configuredRoot || !existingDirectory(configuredRoot))
       continue;
-    const bundleRoot = path64.resolve(configuredRoot);
+    const bundleRoot = path65.resolve(configuredRoot);
     const component = bundleComponentConfig(bundle);
-    const componentRoot = path64.resolve(bundleRoot, component?.root ?? ".");
-    const relative = path64.relative(bundleRoot, componentRoot);
-    if (relative === ".." || relative.startsWith(`..${path64.sep}`) || path64.isAbsolute(relative)) {
+    const componentRoot = path65.resolve(bundleRoot, component?.root ?? ".");
+    const relative = path65.relative(bundleRoot, componentRoot);
+    if (relative === ".." || relative.startsWith(`..${path65.sep}`) || path65.isAbsolute(relative)) {
       throw new ConfigError(`Task migration component root ${componentRoot} escapes bundle ${bundleId} at ${bundleRoot}.`, "INVALID_CONFIG_FILE");
     }
     if (!existingDirectory(componentRoot))
       continue;
     const adapter = component?.adapter ?? detectAdapterId(componentRoot, "");
     if (!component?.adapter && adapter === "") {
-      const flatTasks = fs53.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
+      const flatTasks = fs56.readdirSync(componentRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".yml")).map((entry) => entry.name).sort();
       if (flatTasks.length > 0) {
         throw new ConfigError(`Task migration cannot classify top-level task file(s) ${flatTasks.join(", ")} in bundle ${bundleId}; configure adapter "akm-task" or move them under tasks/.`, "INVALID_CONFIG_FILE");
       }
@@ -96332,8 +96727,8 @@ function applyTaskV3Migration() {
     const before = inspectCurrentTaskPlan();
     if (before.result.taskV3Migration.changed === 0)
       return before.result;
-    const backupRoot = path64.join(getDataDir(), "backups", "task-v3");
-    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path65.join(getDataDir(), "backups", "task-v3");
+    const backupPath = path65.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV3MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskPlan().result;
     if (after.taskV3Migration.changed > 0) {
@@ -96389,8 +96784,8 @@ function applyTaskV4Migration() {
     const before = inspectCurrentTaskV4Plan();
     if (before.result.taskV4Migration.changed === 0)
       return before.result;
-    const backupRoot = path64.join(getDataDir(), "backups", "task-v4");
-    const backupPath = path64.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
+    const backupRoot = path65.join(getDataDir(), "backups", "task-v4");
+    const backupPath = path65.join(backupRoot, `${Date.now()}-${randomUUID7()}`);
     const applied = applyTaskToV4MigrationPlan(before.plan, { backupRoot: backupPath });
     const after = inspectCurrentTaskV4Plan().result;
     if (after.taskV4Migration.changed > 0) {