akm-cli 0.9.16-alpha.1 → 0.9.16

package/dist/commands/sources/installed-stashes.js

@@ -18,7 +18,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isWithin, resolveStashDir } from "../../core/common.js";
-import { acquireConfigReadFence, bundleComponentConfig, getSources, loadConfig } from "../../core/config/config.js";
+import { acquireConfigReadFence, bundleComponentConfig, getSources, loadConfig, resolveSecret, } from "../../core/config/config.js";
 import { AkmError, ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { isPathAbsent } from "../../core/path-access.js";
 import { getDbPath, getRegistryCacheDir } from "../../core/paths.js";
@@ -26,7 +26,7 @@ import { beginImmediateTransaction, getStateDbPath, openStateDatabase } from "..
 import { warn } from "../../core/warn.js";
 import { resolveGitContentRoot } from "../../core/write-source.js";
 import { withAssetMutationLease } from "../../indexer/index-writer-lock.js";
-import { akmIndex, reclassifyIndexDbContention, runEmbeddingPass } from "../../indexer/indexer.js";
+import { akmIndex, runEmbeddingPass } from "../../indexer/indexer.js";
 import { compareAndSwapLockfileSnapshot, publishLockfileUpdate, readLockfile, readLockfileForUpdate, } from "../../integrations/lockfile.js";
 import { parseRegistryRef } from "../../registry/resolve.js";
 import { sha256Hex } from "../../runtime.js";
@@ -106,6 +106,7 @@ function listManagedInstalls(config) {
             componentRoot,
             requiredRoots: lock.localRoot ? [path.resolve(lock.localRoot, componentRoot)] : [],
             auditConfigGeneration: bundleAuditGeneration(bundle),
+            ...(bundle.credential !== undefined ? { credential: bundle.credential } : {}),
         });
     }
     return out;
@@ -312,15 +313,11 @@ export async function akmRemove(input) {
             config: {
                 sourceCount: getSources(updatedConfig).length,
             },
-            // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-            // removed (#index-redesign W6) — this response's own `index` shape is
-            // unchanged, so bridge from the renamed source field;
-            // `directoriesSkipped` was already always 0.
             index: {
                 mode: index.mode,
                 totalEntries: index.totalEntries,
-                directoriesScanned: index.sourcesScanned,
-                directoriesSkipped: 0,
+                directoriesScanned: index.directoriesScanned,
+                directoriesSkipped: index.directoriesSkipped,
             },
         };
     }
@@ -346,15 +343,11 @@ export async function akmRemove(input) {
         config: {
             sourceCount: getSources(updatedConfig).length,
         },
-        // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-        // removed (#index-redesign W6) — this response's own `index` shape is
-        // unchanged, so bridge from the renamed source field;
-        // `directoriesSkipped` was already always 0.
         index: {
             mode: index.mode,
             totalEntries: index.totalEntries,
-            directoriesScanned: index.sourcesScanned,
-            directoriesSkipped: 0,
+            directoriesScanned: index.directoriesScanned,
+            directoriesSkipped: index.directoriesSkipped,
         },
     };
 }
@@ -369,13 +362,14 @@ export async function akmRemove(input) {
 function readCurrentIndexSummary() {
     const db = openReadonlyExistingDatabase(getDbPath());
     if (!db) {
-        return { mode: "incremental", totalEntries: 0, sourcesScanned: 0 };
+        return { mode: "incremental", totalEntries: 0, directoriesScanned: 0, directoriesSkipped: 0 };
     }
     try {
         return {
             mode: "incremental",
             totalEntries: getAllEntries(db).length,
-            sourcesScanned: 0,
+            directoriesScanned: 0,
+            directoriesSkipped: 0,
         };
     }
     finally {
@@ -397,15 +391,11 @@ function buildUpdateResponse(stashDir, target, all, processed, opts) {
         config: {
             sourceCount: getSources(finalConfig).length,
         },
-        // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-        // removed (#index-redesign W6) — `UpdateResponse["index"]`'s own shape is
-        // unchanged, so bridge from the renamed source field;
-        // `directoriesSkipped` was already always 0.
         index: {
             mode: index.mode,
             totalEntries: index.totalEntries,
-            directoriesScanned: index.sourcesScanned,
-            directoriesSkipped: 0,
+            directoriesScanned: index.directoriesScanned,
+            directoriesSkipped: index.directoriesSkipped,
             ...(index.scanComplete !== undefined ? { scanComplete: index.scanComplete } : {}),
             // A real embedding pass (`akmIndex`/`runEmbeddingPass`) reports its own
             // verified `semanticStatus`. When no pass ran this update (the
@@ -473,9 +463,7 @@ function openUnifiedUpdateTransaction() {
                 candidate.exec(`ATTACH DATABASE ${sqliteStringLiteral(statePath)} AS "${UPDATE_STATE_SCHEMA}"`);
                 // openIndexDatabase invokes this before ensureSchema, so the outer
                 // transaction begins before the first update-owned index mutation.
-                // `candidate` is the index.db connection, so contention here must
-                // report as INDEX_DB_CONTENDED, not the state.db default.
-                beginImmediateTransaction(candidate, "index");
+                beginImmediateTransaction(candidate);
             },
         });
         return {
@@ -553,15 +541,7 @@ async function runPostCommitEmbeddingPass(index) {
         return { ...index, verification };
     }
     catch (error) {
-        // Run the failure through the same index.db contention classifier the
-        // drain catch uses (indexer.ts's reclassifyIndexDbContention) before
-        // building the message: this catch's first statement, openIndexDatabase
-        // (init runs ensureSchema and writes), can throw the raw SQLite driver
-        // error under contention, and this was the last surviving non-fatal
-        // catch that printed that raw text verbatim to the operator instead of
-        // reporting it as index.db contention.
-        const reportedError = reclassifyIndexDbContention(error);
-        const message = reportedError instanceof Error ? reportedError.message : String(reportedError);
+        const message = error instanceof Error ? error.message : String(error);
         warn(`[akm bundle update] post-commit embedding pass failed: ${message}`);
         return {
             ...index,
@@ -662,12 +642,12 @@ async function verifyPublishedAudit(prepared, id) {
         throw new ConfigError(`Writable source "${id}" changed while its audited Git target was materialized; refusing to activate unaudited bytes.`, "DANGEROUS_ENV_AUDIT_FAILED");
     }
 }
-async function auditPreparedUpdate(prepared, id, ref, allowInsecure) {
+async function auditPreparedUpdate(prepared, id, ref, allowDangerousEnvKeys) {
     updateTransactionHook("staged", id);
     const decision = await auditStashForDangerousKeys({
         stashRoot: prepared.auditRoot,
         ref,
-        allowDangerousKeys: allowInsecure,
+        allowDangerousKeys: allowDangerousEnvKeys,
         isTTY: process.stdin.isTTY === true,
         operation: "update",
         renderBlockedError: false,
@@ -734,6 +714,7 @@ function prepareWritableManagedUpdate(managed, force) {
         writable: true,
         writableRoot: stagedContentRoot,
         ...(stagedPhysicalRequiredRoots.length > 0 ? { writableRequiredRoots: stagedPhysicalRequiredRoots } : {}),
+        ...(managed.credential ? { credential: resolveSecret(managed.credential, storeSecretResolver.resolveSecret) } : {}),
     })
         .then((staged) => {
         const auditedTargetHead = gitHead(stagedRepo);
@@ -780,6 +761,9 @@ async function prepareManagedUpdate(managed, force) {
             force,
             writable: false,
             cacheRootDir: stagingParent,
+            ...(managed.credential
+                ? { credential: resolveSecret(managed.credential, storeSecretResolver.resolveSecret) }
+                : {}),
         });
         if (!pathAtOrBelow(staged.cacheDir, stagingParent)) {
             // Test/provider seams may return an already-isolated candidate. It remains
@@ -816,9 +800,9 @@ function resolveComponentAuditRoot(contentRoot, componentRoot, id) {
     }
     return resolved;
 }
-async function publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, full, expectedConfigGeneration) {
+async function publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowDangerousEnvKeys, full, expectedConfigGeneration) {
     try {
-        await auditPreparedUpdate(prepared, id, ref, allowInsecure);
+        await auditPreparedUpdate(prepared, id, ref, allowDangerousEnvKeys);
         return await withAssetMutationLease("source-update", async () => {
             let transaction;
             let releaseConfigFence;
@@ -892,14 +876,18 @@ async function prepareGitPlainUpdate(gitSource, componentRoot, writable) {
     const stagingParent = createStagingParent(path.dirname(livePaths.rootDir));
     const stagedPaths = getCachePaths(repo.canonicalUrl, stagingParent);
     try {
-        const expectedOldHead = writable ? gitHead(livePaths.repoDir) : undefined;
-        if (writable && fs.existsSync(livePaths.rootDir)) {
+        const hasLiveCheckout = writable && fs.existsSync(livePaths.repoDir);
+        const expectedOldHead = hasLiveCheckout ? gitHead(livePaths.repoDir) : undefined;
+        if (hasLiveCheckout) {
             fs.cpSync(livePaths.rootDir, stagedPaths.rootDir, { recursive: true, preserveTimestamps: true });
         }
         const staged = await syncMirroredRepo(gitSource, {
             force: true,
             writable,
             cacheRootDir: stagingParent,
+            ...(gitSource.credential
+                ? { credential: resolveSecret(gitSource.credential, storeSecretResolver.resolveSecret) }
+                : {}),
         });
         const configuredStagedAuditRoot = resolveComponentAuditRoot(resolveGitContentRoot(staged.contentDir), componentRoot, gitSource.name ?? "git");
         if (!pathAtOrBelow(staged.cacheDir, stagingParent)) {
@@ -922,7 +910,13 @@ async function prepareGitPlainUpdate(gitSource, componentRoot, writable) {
             const physicalStagedRepo = canonicalWritablePath(stagedPaths.repoDir, "staged plain Git checkout");
             auditRoot = containedWritablePath(configuredStagedAuditRoot, physicalStagedRepo, `Post-sync component root for "${gitSource.name ?? "git"}"`);
             publishedAuditRoot = remapStagedPath(configuredStagedAuditRoot, staged.cacheDir, livePaths.rootDir);
-            publishedAuditContainmentRoot = canonicalWritablePath(livePaths.repoDir, "plain Git checkout");
+            if (hasLiveCheckout) {
+                publishedAuditContainmentRoot = canonicalWritablePath(livePaths.repoDir, "plain Git checkout");
+            }
+            else {
+                const physicalCacheParent = canonicalWritablePath(path.dirname(livePaths.rootDir), "plain Git cache parent");
+                publishedAuditContainmentRoot = path.join(physicalCacheParent, path.basename(livePaths.rootDir), path.relative(livePaths.rootDir, livePaths.repoDir));
+            }
             publishedAuditExpectedPhysicalRoot = path.join(publishedAuditContainmentRoot, path.relative(physicalStagedRepo, auditRoot));
         }
         return {
@@ -930,7 +924,7 @@ async function prepareGitPlainUpdate(gitSource, componentRoot, writable) {
             ...(publishedAuditRoot ? { publishedAuditRoot } : {}),
             ...(publishedAuditContainmentRoot ? { publishedAuditContainmentRoot } : {}),
             ...(publishedAuditExpectedPhysicalRoot ? { publishedAuditExpectedPhysicalRoot } : {}),
-            publication: writable
+            publication: writable && hasLiveCheckout
                 ? writableGitPublication({
                     stagedRepo: stagedPaths.repoDir,
                     liveRepo: livePaths.repoDir,
@@ -945,14 +939,14 @@ async function prepareGitPlainUpdate(gitSource, componentRoot, writable) {
         throw error;
     }
 }
-async function syncGitPlainSource(gitSource, stashDir, allowInsecure) {
+async function syncGitPlainSource(gitSource, stashDir, allowDangerousEnvKeys) {
     const id = gitSource.name ?? gitSource.url ?? "";
     const currentConfig = loadConfig();
     const currentSource = currentPlainSource(currentConfig, id, "git");
     const ref = currentSource.url ?? "";
     const fence = bundleAuditFence(currentConfig, id);
     const prepared = await prepareGitPlainUpdate(currentSource, fence.componentRoot, fence.writable);
-    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, true, fence.generation);
+    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowDangerousEnvKeys, true, fence.generation);
     return { item: { id, kind: "git", ref }, index };
 }
 async function prepareWebsitePlainUpdate(websiteSource, componentRoot) {
@@ -983,24 +977,24 @@ async function prepareWebsitePlainUpdate(websiteSource, componentRoot) {
         throw error;
     }
 }
-async function syncWebsitePlainSource(websiteSource, stashDir, allowInsecure) {
+async function syncWebsitePlainSource(websiteSource, stashDir, allowDangerousEnvKeys) {
     const id = websiteSource.name ?? websiteSource.url ?? "";
     const currentConfig = loadConfig();
     const currentSource = currentPlainSource(currentConfig, id, "website");
     const ref = currentSource.url ?? "";
     const fence = bundleAuditFence(currentConfig, id);
     const prepared = await prepareWebsitePlainUpdate(currentSource, fence.componentRoot);
-    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowInsecure, true, fence.generation);
+    const index = await publishPreparedPlainUpdate(id, ref, prepared, stashDir, allowDangerousEnvKeys, true, fence.generation);
     return { item: { id, kind: "website", ref }, index };
 }
 /** Sync a git-mirrored (plain) source and return an UpdateResponse (single-target path). */
-async function updateGitSource(stashDir, target, all, gitSource, allowInsecure) {
-    const synced = await syncGitPlainSource(gitSource, stashDir, allowInsecure);
+async function updateGitSource(stashDir, target, all, gitSource, allowDangerousEnvKeys) {
+    const synced = await syncGitPlainSource(gitSource, stashDir, allowDangerousEnvKeys);
     return buildUpdateResponse(stashDir, target, all, [], { plainSynced: [synced.item], index: synced.index });
 }
 /** Re-crawl a website (plain) source and return an UpdateResponse (single-target path). */
-async function updateWebsiteSource(stashDir, target, all, websiteSource, allowInsecure) {
-    const synced = await syncWebsitePlainSource(websiteSource, stashDir, allowInsecure);
+async function updateWebsiteSource(stashDir, target, all, websiteSource, allowDangerousEnvKeys) {
+    const synced = await syncWebsitePlainSource(websiteSource, stashDir, allowDangerousEnvKeys);
     return buildUpdateResponse(stashDir, target, all, [], { plainSynced: [synced.item], index: synced.index });
 }
 /** Reconcile a filesystem source's current bytes without provider hydration. */
@@ -1063,7 +1057,7 @@ function managedInstallViewOfPlainNpm(npmSource) {
  * scripts; only the branch that can `rm -rf` needs a gate, not the whole
  * command).
  */
-async function updateManagedInstall(managed, force, yes, stashDir, allowInsecure) {
+async function updateManagedInstall(managed, force, yes, stashDir, allowDangerousEnvKeys) {
     // No pre-cleanup of the old root, even under --force: the providers already
     // re-materialize staging-first (git clones into a `.tmp-*` sibling and swaps
     // only on success), so destroying `managed.localRoot` BEFORE `syncFromRef`
@@ -1072,7 +1066,7 @@ async function updateManagedInstall(managed, force, yes, stashDir, allowInsecure
     // config/lock publication and reindexing both succeed.
     const prepared = await prepareManagedUpdate(managed, force);
     try {
-        await auditPreparedUpdate(prepared, managed.installId, managed.ref, allowInsecure);
+        await auditPreparedUpdate(prepared, managed.installId, managed.ref, allowDangerousEnvKeys);
         const synced = prepared.synced;
         const installedEntry = {
             id: managed.installId,
@@ -1280,14 +1274,14 @@ export async function akmUpdate(input) {
     const all = input?.all === true;
     const force = input?.force === true;
     const yes = input?.yes === true;
-    const allowInsecure = input?.allowInsecure === true;
+    const allowDangerousEnvKeys = input?.allowDangerousEnvKeys === true;
     const config = loadConfig();
     const managedInstalls = listManagedInstalls(config);
     if (target && !all) {
         // Registry-managed install (lock-backed) — re-download from its locator.
         const managed = resolveManagedTarget(config, target);
         if (managed) {
-            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowInsecure);
+            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowDangerousEnvKeys);
             return buildUpdateResponse(stashDir, target, all, [updated.item], { index: updated.index });
         }
         // Plain git / website source (bundles without a lock) — provider re-sync.
@@ -1316,7 +1310,7 @@ export async function akmUpdate(input) {
             return false;
         });
         if (gitMatch)
-            return updateGitSource(stashDir, target, all, gitMatch, allowInsecure);
+            return updateGitSource(stashDir, target, all, gitMatch, allowDangerousEnvKeys);
         const websiteMatch = stashes.find((s) => {
             if (s.type !== "website")
                 return false;
@@ -1329,7 +1323,7 @@ export async function akmUpdate(input) {
             return false;
         });
         if (websiteMatch)
-            return updateWebsiteSource(stashDir, target, all, websiteMatch, allowInsecure);
+            return updateWebsiteSource(stashDir, target, all, websiteMatch, allowDangerousEnvKeys);
         // Plain npm source (bundle without a lock) — sync via the registry
         // pipeline and promote to a managed install (see
         // managedInstallViewOfPlainNpm's doc comment for why npm can't stay
@@ -1344,7 +1338,7 @@ export async function akmUpdate(input) {
             return false;
         });
         if (npmMatch) {
-            const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(npmMatch), force, yes, stashDir, allowInsecure);
+            const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(npmMatch), force, yes, stashDir, allowDangerousEnvKeys);
             return buildUpdateResponse(stashDir, target, all, [updated.item], { index: updated.index });
         }
         const filesystemMatch = stashes.find((source) => {
@@ -1367,7 +1361,7 @@ export async function akmUpdate(input) {
     let latestIndex;
     for (const managed of selected) {
         try {
-            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowInsecure);
+            const updated = await updateManagedInstall(managed, force, yes, stashDir, allowDangerousEnvKeys);
             processed.push(updated.item);
             latestIndex = updated.index;
         }
@@ -1392,17 +1386,17 @@ export async function akmUpdate(input) {
             const id = plain.name ?? plain.path ?? plain.url ?? "";
             try {
                 if (plain.type === "git") {
-                    const updated = await syncGitPlainSource(plain, stashDir, allowInsecure);
+                    const updated = await syncGitPlainSource(plain, stashDir, allowDangerousEnvKeys);
                     plainSynced.push(updated.item);
                     latestIndex = updated.index;
                 }
                 else if (plain.type === "npm") {
-                    const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(plain), force, yes, stashDir, allowInsecure);
+                    const updated = await updateManagedInstall(managedInstallViewOfPlainNpm(plain), force, yes, stashDir, allowDangerousEnvKeys);
                     processed.push(updated.item);
                     latestIndex = updated.index;
                 }
                 else if (plain.type === "website") {
-                    const updated = await syncWebsitePlainSource(plain, stashDir, allowInsecure);
+                    const updated = await syncWebsitePlainSource(plain, stashDir, allowDangerousEnvKeys);
                     plainSynced.push(updated.item);
                     latestIndex = updated.index;
                 }

package/dist/commands/sources/source-add.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isBundleSlug } from "../../core/asset/asset-ref.js";
 import { isHttpUrl, resolveStashDir } from "../../core/common.js";
-import { bundleEntryToSourceEntry, getSources, installedSourceDescriptor, loadConfig, mutateConfig, } from "../../core/config/config.js";
+import { bundleEntryToSourceEntry, getSources, installedSourceDescriptor, loadConfig, mutateConfig, resolveSecret, } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { akmIndex } from "../../indexer/indexer.js";
 import { deriveBundleId } from "../../indexer/installations.js";
@@ -16,7 +16,8 @@ import { detectStashRoot } from "../../sources/providers/provider-utils.js";
 import { syncFromRef } from "../../sources/providers/sync-from-ref.js";
 import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { ensureWebsiteMirror, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteInputUrl, } from "../../sources/snapshot-fetchers/website-ingest.js";
-import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
+import { revokeSchedulerActivationsForBundle } from "../../tasks/activation-config.js";
+import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey, placeBundle, } from "./bundle-config-ops.js";
 export async function akmAdd(input) {
     const ref = input.ref.trim();
     if (!ref)
@@ -24,23 +25,23 @@ export async function akmAdd(input) {
             "Examples: `akm bundle add @scope/stash`, `akm bundle add github:owner/repo`, `akm bundle add ./local/path`");
     const stashDir = resolveStashDir();
     if (shouldAddAsWebsiteUrl(ref)) {
-        return addWebsiteSource(ref, stashDir, input.name, input.options);
+        return addWebsiteSource(ref, stashDir, input.name, input.options, input);
     }
     // Local directories become filesystem bundles; registry refs use the
     // registry-backed bundle installer below.
     try {
         const parsed = parseRegistryRef(ref);
         if (parsed.source === "local") {
-            return addLocalSource(ref, parsed.sourcePath, stashDir, input.name, input.adapter);
+            return addLocalSource(ref, parsed.sourcePath, stashDir, input.name, input.adapter, input);
         }
     }
     catch {
         // Not a local ref — fall through to registry install
     }
-    return addRegistryStash(ref, stashDir, input.writable);
+    return addRegistryStash(ref, stashDir, input.writable, input, input.credential);
 }
 /** Add a local directory as a filesystem bundle. */
-async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitAdapter) {
+async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitAdapter, position = {}) {
     const stashRoot = detectStashRoot(sourcePath);
     const resolvedPath = path.resolve(stashRoot);
     const adapter = explicitAdapter ?? detectAdapterId(resolvedPath);
@@ -62,11 +63,11 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitA
         }
         const bundles = { ...(config.bundles ?? {}) };
         bundleKey = nextBundleKey(bundles, explicitName, resolvedPath);
-        bundles[bundleKey] = {
+        const entry = {
             path: resolvedPath,
             components: { main: { root: ".", adapter } },
         };
-        return { ...config, bundles };
+        return { ...config, bundles: placeBundle(bundles, bundleKey, entry, position) };
     });
     const index = await akmIndex({ stashDir });
     const updatedConfig = loadConfig();
@@ -86,18 +87,13 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitA
         index: {
             mode: index.mode,
             totalEntries: index.totalEntries,
-            // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-            // removed (#index-redesign W6: reconcile is a flat per-file stat walk,
-            // never a directory walk) — this response's own `directoriesScanned`/
-            // `directoriesSkipped` shape is unchanged, so bridge from the renamed
-            // source field; `directoriesSkipped` was already always 0.
-            directoriesScanned: index.sourcesScanned,
-            directoriesSkipped: 0,
+            directoriesScanned: index.directoriesScanned,
+            directoriesSkipped: index.directoriesSkipped,
             ...(index.warnings?.length ? { warnings: index.warnings } : {}),
         },
     };
 }
-async function addWebsiteSource(ref, stashDir, name, options) {
+async function addWebsiteSource(ref, stashDir, name, options, position = {}) {
     const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(ref);
     const normalizedUrl = validateWebsiteInputUrl(ref, { allowPrivateHosts });
     const numberOption = (value) => (typeof value === "number" ? value : undefined);
@@ -129,9 +125,9 @@ async function addWebsiteSource(ref, stashDir, name, options) {
             entry = bundleEntryToSourceEntry(key, bundles[key]);
             return config;
         }
-        bundles[key] = nextBundle;
+        const nextBundles = placeBundle(bundles, key, nextBundle, position);
         entry = bundleEntryToSourceEntry(key, nextBundle);
-        return { ...config, bundles };
+        return { ...config, bundles: nextBundles };
     });
     const cachePaths = await ensureWebsiteMirror(entry, {
         requireStashDir: true,
@@ -156,13 +152,8 @@ async function addWebsiteSource(ref, stashDir, name, options) {
         index: {
             mode: index.mode,
             totalEntries: index.totalEntries,
-            // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-            // removed (#index-redesign W6: reconcile is a flat per-file stat walk,
-            // never a directory walk) — this response's own `directoriesScanned`/
-            // `directoriesSkipped` shape is unchanged, so bridge from the renamed
-            // source field; `directoriesSkipped` was already always 0.
-            directoriesScanned: index.sourcesScanned,
-            directoriesSkipped: 0,
+            directoriesScanned: index.directoriesScanned,
+            directoriesSkipped: index.directoriesSkipped,
             ...(index.warnings?.length ? { warnings: index.warnings } : {}),
         },
     };
@@ -171,11 +162,14 @@ async function addWebsiteSource(ref, stashDir, name, options) {
  * Install a stash from a registry (npm, github, git) by dispatching to the
  * matching syncable provider and persisting the lock entry.
  */
-async function addRegistryStash(ref, stashDir, writable) {
+async function addRegistryStash(ref, stashDir, writable, position = {}, credentialRef) {
     const parsedRef = parseRegistryRef(ref);
     if (writable === true && parsedRef.source !== "git" && parsedRef.source !== "github") {
         throw new ConfigError("writable: true is only supported on filesystem and git sources", "INVALID_CONFIG_FILE");
     }
+    if (credentialRef && parsedRef.source !== "git" && parsedRef.source !== "github") {
+        throw new ConfigError("credential is only supported on git sources", "INVALID_CONFIG_FILE");
+    }
     const currentConfig = loadConfig();
     const existingBundleKey = findInstalledBundleKey(currentConfig.bundles ?? {}, parsedRef.id);
     const existingBundle = existingBundleKey ? currentConfig.bundles?.[existingBundleKey] : undefined;
@@ -189,6 +183,11 @@ async function addRegistryStash(ref, stashDir, writable) {
         writable: effectiveWritable,
         ...(effectiveWritable && priorLock?.localRoot ? { writableRoot: priorLock.localRoot } : {}),
         ...(requiredRoots.length > 0 ? { writableRequiredRoots: requiredRoots } : {}),
+        ...(credentialRef
+            ? { credential: resolveSecret(credentialRef, storeSecretResolver.resolveSecret) }
+            : existingBundle?.credential
+                ? { credential: resolveSecret(existingBundle.credential, storeSecretResolver.resolveSecret) }
+                : {}),
     });
     const { config: updatedConfig, bundleId } = upsertInstalledRegistryEntry({
         id: synced.id,
@@ -201,7 +200,7 @@ async function addRegistryStash(ref, stashDir, writable) {
         cacheDir: synced.cacheDir,
         installedAt: synced.syncedAt,
         writable: synced.writable,
-    });
+    }, position, credentialRef);
     // The prior materialized root (if this is a re-install) — read BEFORE the lock
     // upsert overwrites it, so a moved cache root can be cleaned afterwards.
     const priorLocalRoot = priorLock?.localRoot;
@@ -248,13 +247,8 @@ async function addRegistryStash(ref, stashDir, writable) {
         index: {
             mode: index.mode,
             totalEntries: index.totalEntries,
-            // `IndexResponse.directoriesScanned`/`directoriesSkipped` were renamed/
-            // removed (#index-redesign W6: reconcile is a flat per-file stat walk,
-            // never a directory walk) — this response's own `directoriesScanned`/
-            // `directoriesSkipped` shape is unchanged, so bridge from the renamed
-            // source field; `directoriesSkipped` was already always 0.
-            directoriesScanned: index.sourcesScanned,
-            directoriesSkipped: 0,
+            directoriesScanned: index.directoriesScanned,
+            directoriesSkipped: index.directoriesSkipped,
             ...(index.warnings?.length ? { warnings: index.warnings } : {}),
         },
     };
@@ -267,7 +261,7 @@ async function addRegistryStash(ref, stashDir, writable) {
  * via {@link upsertLockEntry} with the returned `bundleId`). Returns the config
  * plus the derived bundle id so the caller keys its lock entry identically.
  */
-export function upsertInstalledRegistryEntry(entry) {
+export function upsertInstalledRegistryEntry(entry, position = {}, credential) {
     let bundleId = entry.id;
     const config = mutateConfig((current) => {
         const bundles = { ...(current.bundles ?? {}) };
@@ -286,13 +280,15 @@ export function upsertInstalledRegistryEntry(entry) {
                 },
             };
         const descriptor = installedSourceDescriptor(entry.source, entry.ref, path.resolve(entry.stashRoot));
-        bundles[bundleId] = {
+        const effectiveCredential = credential ?? bundles[bundleId]?.credential;
+        const nextEntry = {
             ...descriptor,
+            ...(effectiveCredential ? { credential: effectiveCredential } : {}),
             ...(entry.writable === true ? { writable: true } : {}),
             ...(entry.id !== bundleId ? { registryId: entry.id } : {}),
             components: components,
         };
-        return { ...current, bundles };
+        return { ...current, bundles: placeBundle(bundles, bundleId, nextEntry, position) };
     }).config;
     return { config, bundleId };
 }
@@ -310,7 +306,12 @@ export async function removeInstalledRegistryEntry(id) {
             return current;
         removedKey = key;
         delete bundles[key];
-        return { ...current, bundles: Object.keys(bundles).length > 0 ? bundles : undefined };
+        return revokeSchedulerActivationsForBundle({
+            ...current,
+            bundles: Object.keys(bundles).length > 0 ? bundles : undefined,
+            ...(current.defaultBundle === key ? { defaultBundle: undefined } : {}),
+            ...(current.defaultWriteTarget === key ? { defaultWriteTarget: undefined } : {}),
+        }, key);
     }).config;
     if (removedKey)
         await removeLockEntry(removedKey);