superbee 0.1.5 → 0.1.6

package/dist/superbee.mjs

@@ -44,7 +44,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_SUPERBEE_BUILD_IDENTITY_default;
 var init_define_SUPERBEE_BUILD_IDENTITY = __esm({
   "<define:__SUPERBEE_BUILD_IDENTITY__>"() {
-    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.1.5" }, source: { commit: "ffeb9c61f8ae42b215b4913725c564afbbd19402", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
+    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.1.6" }, source: { commit: "f1d6619026f0532f676c9cc22e31793a186b7cf6", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
   }
 });
 
@@ -3604,8 +3604,8 @@ var require_js_yaml2 = __commonJS({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
-    var yaml3 = require_js_yaml();
-    module2.exports = yaml3;
+    var yaml4 = require_js_yaml();
+    module2.exports = yaml4;
   }
 });
 
@@ -4020,6 +4020,70 @@ var require_gray_matter = __commonJS({
   }
 });
 
+// ../core/src/frontmatter-contract.ts
+function isUsableTimestamp(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+var MalformedDocumentError;
+var init_frontmatter_contract = __esm({
+  "../core/src/frontmatter-contract.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    MalformedDocumentError = class extends Error {
+      name = "MalformedDocumentError";
+      context;
+      detail;
+      constructor(context, cause) {
+        const detail = ((cause instanceof Error ? cause.message : String(cause)).split("\n")[0] ?? "").trim();
+        super(
+          `malformed frontmatter${context ? ` in '${context}'` : ""}: ${detail} \u2014 fix the YAML or remove the file`
+        );
+        if (context !== void 0) this.context = context;
+        this.detail = detail;
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+  }
+});
+
+// ../core/src/frontmatter-splitter.ts
+function delimiterLineEnd(input, offset) {
+  if (!input.startsWith("---", offset)) return null;
+  const suffix = offset + 3;
+  if (suffix === input.length) return suffix;
+  if (input[suffix] === "\n") return suffix + 1;
+  if (input[suffix] === "\r" && input[suffix + 1] === "\n") return suffix + 2;
+  return null;
+}
+function splitLeadingFrontmatter(raw, context) {
+  const input = raw.startsWith("\uFEFF") ? raw.slice(1) : raw;
+  const openingEnd = delimiterLineEnd(input, 0);
+  if (openingEnd === null) return { body: input };
+  let lineStart = openingEnd;
+  while (lineStart < input.length) {
+    const closingEnd = delimiterLineEnd(input, lineStart);
+    if (closingEnd !== null) {
+      return {
+        yamlSource: input.slice(openingEnd, lineStart),
+        body: input.slice(closingEnd)
+      };
+    }
+    const nextLineFeed = input.indexOf("\n", lineStart);
+    if (nextLineFeed === -1) break;
+    lineStart = nextLineFeed + 1;
+  }
+  throw new MalformedDocumentError(context, new Error("unterminated YAML frontmatter delimiter"));
+}
+var init_frontmatter_splitter = __esm({
+  "../core/src/frontmatter-splitter.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_frontmatter_contract();
+  }
+});
+
 // ../core/src/frontmatter.ts
 function requireYamlTimestampType() {
   const type = import_js_yaml.default.DEFAULT_SAFE_SCHEMA.implicit.find(
@@ -4042,21 +4106,16 @@ function normalizeFrontmatter(data) {
   return out;
 }
 function parseMarkdown(raw, context) {
-  if (/^---(?:\r?\n|$)/.test(raw)) {
-    const firstLineEnd = raw.indexOf("\n");
-    const afterOpening = firstLineEnd === -1 ? "" : raw.slice(firstLineEnd + 1);
-    if (!/^---\r?$/m.test(afterOpening)) {
-      throw new MalformedDocumentError(context, new Error("unterminated YAML frontmatter delimiter"));
-    }
-  }
+  const split = splitLeadingFrontmatter(raw, context);
+  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
   let parsed;
   try {
-    parsed = (0, import_gray_matter.default)(raw, { engines: { yaml: yamlEngine } });
+    parsed = yamlEngine.parse(split.yamlSource);
   } catch (err) {
     throw new MalformedDocumentError(context, err);
   }
-  const frontmatter = normalizeFrontmatter(parsed.data ?? {});
-  return { frontmatter, body: parsed.content };
+  const frontmatter = normalizeFrontmatter(parsed);
+  return { frontmatter, body: split.body };
 }
 function normalizeDocumentBodyForStorage(body) {
   return body.endsWith("\n") ? body : `${body}
@@ -4064,22 +4123,19 @@ function normalizeDocumentBodyForStorage(body) {
 }
 function stringifyWithData(data, body) {
   const engines2 = import_gray_matter.default.engines;
-  const yaml3 = engines2.yaml.stringify(data).trim();
+  const yaml4 = engines2.yaml.stringify(data).trim();
   const content3 = body ?? "";
   const newline = (value) => value.endsWith("\n") ? value : `${value}
 `;
-  if (yaml3 === "{}") return normalizeDocumentBodyForStorage(content3);
+  if (yaml4 === "{}") return normalizeDocumentBodyForStorage(content3);
   return `---
-${newline(yaml3)}---
+${newline(yaml4)}---
 ${normalizeDocumentBodyForStorage(content3)}`;
 }
 function stringifyDoc(frontmatter, body) {
   return stringifyWithData(frontmatter, body);
 }
-function isUsableTimestamp(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-var import_gray_matter, import_js_yaml, YAML_TIMESTAMP_TAG, yamlTimestampType, stringTimestampType, losslessDateSchema, yamlEngine, MalformedDocumentError;
+var import_gray_matter, import_js_yaml, YAML_TIMESTAMP_TAG, yamlTimestampType, stringTimestampType, losslessDateSchema, yamlEngine;
 var init_frontmatter = __esm({
   "../core/src/frontmatter.ts"() {
     "use strict";
@@ -4087,6 +4143,9 @@ var init_frontmatter = __esm({
     init_define_SUPERBEE_UPDATE_POLICY();
     import_gray_matter = __toESM(require_gray_matter(), 1);
     import_js_yaml = __toESM(require_js_yaml2(), 1);
+    init_frontmatter_contract();
+    init_frontmatter_splitter();
+    init_frontmatter_contract();
     YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
     yamlTimestampType = requireYamlTimestampType();
     stringTimestampType = new import_js_yaml.default.Type(YAML_TIMESTAMP_TAG, {
@@ -4103,22 +4162,6 @@ var init_frontmatter = __esm({
         return import_js_yaml.default.safeLoad(input, { schema: losslessDateSchema }) ?? {};
       }
     };
-    MalformedDocumentError = class extends Error {
-      name = "MalformedDocumentError";
-      /** The document id/path the malformed content belongs to (when the caller supplied one). */
-      context;
-      /** The underlying parser message, first line only — for compact per-doc reporting. */
-      detail;
-      constructor(context, cause) {
-        const detail = ((cause instanceof Error ? cause.message : String(cause)).split("\n")[0] ?? "").trim();
-        super(
-          `malformed frontmatter${context ? ` in '${context}'` : ""}: ${detail} \u2014 fix the YAML or remove the file`
-        );
-        if (context !== void 0) this.context = context;
-        this.detail = detail;
-        if (cause !== void 0) this.cause = cause;
-      }
-    };
   }
 });
 
@@ -5137,6 +5180,38 @@ var init_mutation_attribution = __esm({
   }
 });
 
+// ../core/src/version-transport.ts
+function stripETagWrapper(raw) {
+  let value = raw.trim();
+  if (value.startsWith("W/")) value = value.slice(2);
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+    value = value.slice(1, -1);
+  }
+  return value;
+}
+var VersionConflict;
+var init_version_transport = __esm({
+  "../core/src/version-transport.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    VersionConflict = class extends Error {
+      name = "VersionConflict";
+      id;
+      expected;
+      actual;
+      constructor(id, expected, actual) {
+        super(
+          `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
+        );
+        this.id = id;
+        this.expected = expected;
+        this.actual = actual;
+      }
+    };
+  }
+});
+
 // ../core/src/versioning.ts
 import { createHash as createHash4 } from "node:crypto";
 function sha256Hex(input) {
@@ -5151,39 +5226,16 @@ function versionOfBytes(raw) {
 function blobVersion(bytes) {
   return `sha256:${createHash4("sha256").update(bytes).digest("hex")}`;
 }
-function stripETagWrapper(raw) {
-  let v2 = raw.trim();
-  if (v2.startsWith("W/")) v2 = v2.slice(2);
-  if (v2.length >= 2 && v2.startsWith('"') && v2.endsWith('"')) v2 = v2.slice(1, -1);
-  return v2;
-}
 function defaultActor() {
   return process.env.USER?.trim() || process.env.USERNAME?.trim() || process.env.LOGNAME?.trim() || "local";
 }
-var VersionConflict;
 var init_versioning = __esm({
   "../core/src/versioning.ts"() {
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
     init_frontmatter();
-    VersionConflict = class extends Error {
-      name = "VersionConflict";
-      /** The concept id whose write was rejected. */
-      id;
-      /** The version the caller expected the backend to currently hold (`null` = expected absent). */
-      expected;
-      /** The version the backend actually holds (`null` if the document does not exist). */
-      actual;
-      constructor(id, expected, actual) {
-        super(
-          `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
-        );
-        this.id = id;
-        this.expected = expected;
-        this.actual = actual;
-      }
-    };
+    init_version_transport();
   }
 });
 
@@ -5534,17 +5586,6 @@ var init_document_write_policy = __esm({
   }
 });
 
-// ../core/src/index-marker.ts
-var GENERATED_INDEX_MARKER;
-var init_index_marker = __esm({
-  "../core/src/index-marker.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-    GENERATED_INDEX_MARKER = "<!-- agentstate-lite:generated-index:v1 -->";
-  }
-});
-
 // ../core/src/links.ts
 function normalizeSegments(segments) {
   const out = [];
@@ -5581,9 +5622,45 @@ function isExternalHref(href) {
 }
 function extractMarkdownLinks(body) {
   const out = [];
-  for (const m2 of body.matchAll(MD_LINK_RE)) {
-    if (typeof m2.index === "number" && m2.index > 0 && body[m2.index - 1] === "!") continue;
-    out.push({ text: m2[1] ?? "", href: m2[2] ?? "" });
+  let textOpen = -1;
+  let afterClose;
+  let hrefFirst;
+  let hrefRest;
+  for (let cursor = 0; cursor < body.length; cursor++) {
+    const char = body[cursor];
+    if (hrefRest) {
+      if (char === ")") {
+        if (hrefRest.open === 0 || body[hrefRest.open - 1] !== "!") {
+          out.push({
+            text: body.slice(hrefRest.open + 1, hrefRest.close),
+            href: body.slice(hrefRest.hrefStart, cursor)
+          });
+        }
+        textOpen = -1;
+        afterClose = void 0;
+        hrefFirst = void 0;
+        hrefRest = void 0;
+        continue;
+      }
+      if (char.trim() === "") hrefRest = void 0;
+    }
+    if (hrefFirst) {
+      if (char !== ")" && char.trim() !== "" && !hrefRest) {
+        hrefRest = hrefFirst;
+      }
+      hrefFirst = void 0;
+    }
+    if (afterClose) {
+      if (char === "(") {
+        hrefFirst = { ...afterClose, hrefStart: cursor + 1 };
+      }
+      afterClose = void 0;
+    }
+    if (textOpen >= 0 && char === "]") {
+      afterClose = { open: textOpen, close: cursor };
+      textOpen = -1;
+    }
+    if (char === "[" && textOpen < 0) textOpen = cursor;
   }
   return out;
 }
@@ -5631,7 +5708,6 @@ function parseLinksFromDoc(doc2) {
   }
   return links;
 }
-var MD_LINK_RE;
 var init_links = __esm({
   "../core/src/links.ts"() {
     "use strict";
@@ -5639,7 +5715,34 @@ var init_links = __esm({
     init_define_SUPERBEE_UPDATE_POLICY();
     init_paths();
     init_errors();
-    MD_LINK_RE = /\[([^\]]*)\]\(([^)\s]+)\)/g;
+  }
+});
+
+// ../core/src/portable-frontmatter.ts
+function parseLeadingFrontmatter(raw, context) {
+  const split = splitLeadingFrontmatter(raw, context);
+  if (!("yamlSource" in split)) return {};
+  try {
+    const parsed = import_js_yaml2.default.safeLoad(split.yamlSource);
+    if (parsed === void 0 || parsed === null) return {};
+    if (typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new TypeError("YAML frontmatter must be a mapping");
+    }
+    return parsed;
+  } catch (error51) {
+    if (error51 instanceof MalformedDocumentError) throw error51;
+    throw new MalformedDocumentError(context, error51);
+  }
+}
+var import_js_yaml2;
+var init_portable_frontmatter = __esm({
+  "../core/src/portable-frontmatter.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    import_js_yaml2 = __toESM(require_js_yaml2(), 1);
+    init_frontmatter_contract();
+    init_frontmatter_splitter();
   }
 });
 
@@ -5669,47 +5772,13 @@ var init_query_filter = __esm({
   }
 });
 
-// ../core/src/bundle.ts
-import path4 from "node:path";
-function backendFor(bundle) {
-  return bundle.backend ?? new FilesystemBackend(bundle.root);
-}
-async function readBundleOkfVersion(bundle) {
-  const index2 = await backendFor(bundle).readReserved("", "index.md");
+// ../core/src/engine.ts
+async function readBundleOkfVersion(backend) {
+  const index2 = await backend.readReserved("", "index.md");
   if (!index2) return void 0;
-  const value = parseMarkdown(index2.content, "index.md").frontmatter.okf_version;
+  const value = parseLeadingFrontmatter(index2.content, "index.md").okf_version;
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-function resolveOkfAuthoringVersion(requested) {
-  const version2 = requested ?? DEFAULT_OKF_AUTHORING_VERSION;
-  if (!SUPPORTED_OKF_AUTHORING_VERSIONS.includes(version2)) {
-    throw new InvalidInputError(
-      `Unsupported OKF authoring version '${version2}'. This build can author ${SUPPORTED_OKF_AUTHORING_VERSIONS.join(" and ")}; bundles declaring other versions can still be read or transported.`
-    );
-  }
-  return version2;
-}
-async function initBundle(root, options2 = {}) {
-  const okfVersion = resolveOkfAuthoringVersion(options2.okfVersion);
-  const resolved = path4.resolve(root);
-  const backend = new FilesystemBackend(resolved);
-  if (options2.expectNew || await backend.readReserved("", "index.md") === null) {
-    const name = path4.basename(resolved);
-    const body = `${GENERATED_INDEX_MARKER}
-# ${name}
-
-An Open Knowledge Format bundle.
-`;
-    try {
-      await backend.writeReserved("", "index.md", stringifyWithData({ okf_version: okfVersion }, body), {
-        expectedVersion: null
-      });
-    } catch (err) {
-      if (options2.expectNew || !(err instanceof VersionConflict)) throw err;
-    }
-  }
-  return { root: resolved };
-}
 function assertWritableConceptDocument(doc2) {
   assertSafeConceptId(doc2.id);
   const rel = pathFromConceptId(doc2.id);
@@ -5726,16 +5795,7 @@ function assertWritableConceptDocument(doc2) {
   }
   return type;
 }
-async function writeDocVersioned(bundle, doc2, options2) {
-  const type = assertWritableConceptDocument(doc2);
-  const okfVersion = await readBundleOkfVersion(bundle) ?? "0.1";
-  return persistDocForEdition(bundle, doc2, type, okfVersion, options2);
-}
-async function writeDocVersionedForEdition(bundle, doc2, okfVersion, options2) {
-  const type = assertWritableConceptDocument(doc2);
-  return persistDocForEdition(bundle, doc2, type, okfVersion, options2);
-}
-async function persistDocForEdition(bundle, doc2, type, okfVersion, options2) {
+async function persistDocForEdition(backend, doc2, type, okfVersion, options2) {
   let saved;
   if (okfVersion === "0.1") {
     const existingTimestamp = doc2.frontmatter.timestamp;
@@ -5744,43 +5804,49 @@ async function persistDocForEdition(bundle, doc2, type, okfVersion, options2) {
   } else {
     saved = normalizeV02DocumentForWrite(doc2, type);
   }
-  const version2 = await backendFor(bundle).write(doc2.id, saved, options2);
+  const version2 = await backend.write(doc2.id, saved, options2);
   return { doc: saved, version: version2 };
 }
-async function readDocVersioned(bundle, id) {
-  assertSafeConceptId(id);
-  const rel = pathFromConceptId(id);
-  if (isReservedFile(rel)) {
-    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
-  }
-  return backendFor(bundle).read(id);
+async function writeDocVersioned(backend, doc2, options2) {
+  const type = assertWritableConceptDocument(doc2);
+  const okfVersion = await readBundleOkfVersion(backend) ?? "0.1";
+  return persistDocForEdition(backend, doc2, type, okfVersion, options2);
 }
-async function readDoc(bundle, id) {
-  return (await readDocVersioned(bundle, id)).doc;
+async function writeDocVersionedForEdition(backend, doc2, okfVersion, options2) {
+  return persistDocForEdition(backend, doc2, assertWritableConceptDocument(doc2), okfVersion, options2);
 }
-async function existsDoc(bundle, id) {
+function assertReadableConceptId(id) {
   assertSafeConceptId(id);
   const rel = pathFromConceptId(id);
   if (isReservedFile(rel)) {
     throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
   }
-  return backendFor(bundle).exists(id);
 }
-async function docVersions(bundle, id) {
-  assertSafeConceptId(id);
-  const rel = pathFromConceptId(id);
-  if (isReservedFile(rel)) {
-    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
-  }
-  return backendFor(bundle).versions(id);
+async function readDocVersioned(backend, id) {
+  assertReadableConceptId(id);
+  return backend.read(id);
+}
+async function readDoc(backend, id) {
+  return (await readDocVersioned(backend, id)).doc;
+}
+async function existsDoc(backend, id) {
+  assertReadableConceptId(id);
+  return backend.exists(id);
+}
+async function docVersions(backend, id) {
+  assertReadableConceptId(id);
+  return backend.versions(id);
 }
-async function deleteDoc(bundle, id, options2) {
+async function deleteDoc(backend, id, options2) {
   assertSafeConceptId(id);
   const rel = pathFromConceptId(id);
   if (isReservedFile(rel)) {
     throw new InvalidInputError(`'${id}' is a reserved file (${rel}); reserved files cannot be deleted.`);
   }
-  return backendFor(bundle).delete(id, options2);
+  return backend.delete(id, options2);
+}
+function isEnoent(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
 async function readManyExisting(backend, ids, onMalformed) {
   try {
@@ -5792,13 +5858,13 @@ async function readManyExisting(backend, ids, onMalformed) {
     for (const id of ids) {
       try {
         out.push(await backend.read(id));
-      } catch (e) {
-        if (isEnoent(e)) continue;
-        if (e instanceof MalformedDocumentError && onMalformed) {
-          onMalformed({ id, reason: e.detail });
+      } catch (candidate) {
+        if (isEnoent(candidate)) continue;
+        if (candidate instanceof MalformedDocumentError && onMalformed) {
+          onMalformed({ id, reason: candidate.detail });
           continue;
         }
-        throw e;
+        throw candidate;
       }
     }
     return out;
@@ -5808,27 +5874,27 @@ async function scanMatching(backend, filter, onSkip) {
   const ids = await backend.list(filter.prefix);
   const results = [];
   for (const result3 of await readManyExisting(backend, ids, onSkip)) {
-    if (!matchesFilter(result3.doc, filter)) continue;
-    results.push(result3);
+    if (matchesFilter(result3.doc, filter)) results.push(result3);
   }
   results.sort((a, b) => a.doc.id.localeCompare(b.doc.id));
   return results;
 }
-async function query(bundle, filter = {}, options2 = {}) {
-  const scanned = await scanMatching(backendFor(bundle), filter, options2.onSkip);
-  return scanned.map((r2) => r2.doc);
+async function query(backend, filter = {}, options2 = {}) {
+  return (await scanMatching(backend, filter, options2.onSkip)).map((result3) => result3.doc);
 }
-async function queryHeads(bundle, filter = {}, options2 = {}) {
-  const backend = backendFor(bundle);
+async function queryHeads(backend, filter = {}, options2 = {}) {
   if (backend.queryHeads) {
-    const rows = (await backend.queryHeads(filter)).filter((r2) => matchesFilter(r2, filter));
+    const rows = (await backend.queryHeads(filter)).filter((row2) => matchesFilter(row2, filter));
     rows.sort((a, b) => a.id.localeCompare(b.id));
     return rows;
   }
-  const scanned = await scanMatching(backend, filter, options2.onSkip);
-  return scanned.map(({ doc: doc2, version: version2 }) => ({ id: doc2.id, frontmatter: doc2.frontmatter, version: version2 }));
+  return (await scanMatching(backend, filter, options2.onSkip)).map(({ doc: doc2, version: version2 }) => ({
+    id: doc2.id,
+    frontmatter: doc2.frontmatter,
+    version: version2
+  }));
 }
-function parseLinks(_bundle, doc2) {
+function parseLinks(doc2) {
   return parseLinksFromDoc(doc2);
 }
 function normalizeEdgeSelector(raw) {
@@ -5842,25 +5908,19 @@ function normalizeEdgeSelector(raw) {
 }
 function matchesEdgeSelector(value, selectors) {
   if (selectors === void 0) return true;
-  for (const normalized of selectors) {
-    if (normalized.endsWith("/")) {
-      if (value.startsWith(normalized)) return true;
-    } else if (value === normalized) {
-      return true;
-    }
-  }
-  return false;
+  return selectors.some(
+    (selector2) => selector2.endsWith("/") ? value.startsWith(selector2) : value === selector2
+  );
 }
-function toSelectorList(v2) {
-  if (v2 === void 0) return void 0;
-  return Array.isArray(v2) ? v2 : [v2];
+function toSelectorList(value) {
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value : [value];
 }
-async function queryEdges(bundle, filter = {}) {
+async function queryEdges(backend, filter = {}) {
   const fromSelectors = toSelectorList(filter.from)?.map(normalizeEdgeSelector);
   const toSelectors = toSelectorList(filter.to)?.map(normalizeEdgeSelector);
-  const docs = await query(bundle);
   const edges = [];
-  for (const doc2 of docs) {
+  for (const doc2 of await query(backend)) {
     for (const link3 of parseLinksFromDoc(doc2)) {
       if (!matchesEdgeSelector(link3.from, fromSelectors)) continue;
       if (!matchesEdgeSelector(link3.to, toSelectors)) continue;
@@ -5871,40 +5931,145 @@ async function queryEdges(bundle, filter = {}) {
   edges.sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to) || a.text.localeCompare(b.text));
   return edges;
 }
-async function backlinks(bundle, target) {
+async function backlinks(backend, target) {
   if (target.endsWith("/")) return [];
-  return queryEdges(bundle, { to: target });
+  return queryEdges(backend, { to: target });
+}
+async function readBlob(backend, key) {
+  return backend.readBlob(key);
+}
+async function writeBlob(backend, key, bytes, contentType, options2) {
+  return backend.writeBlob(key, bytes, contentType, options2);
+}
+async function listBlobs(backend, prefix) {
+  return backend.listBlobs(prefix);
+}
+async function deleteBlob(backend, key, options2) {
+  return backend.deleteBlob(key, options2);
+}
+var init_engine = __esm({
+  "../core/src/engine.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_document_write_policy();
+    init_errors();
+    init_frontmatter_contract();
+    init_links();
+    init_paths();
+    init_portable_frontmatter();
+    init_query_filter();
+  }
+});
+
+// ../core/src/index-marker.ts
+var GENERATED_INDEX_MARKER;
+var init_index_marker = __esm({
+  "../core/src/index-marker.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    GENERATED_INDEX_MARKER = "<!-- agentstate-lite:generated-index:v1 -->";
+  }
+});
+
+// ../core/src/bundle.ts
+import path4 from "node:path";
+function backendFor(bundle) {
+  return bundle.backend ?? new FilesystemBackend(bundle.root);
+}
+async function readBundleOkfVersion2(bundle) {
+  return readBundleOkfVersion(backendFor(bundle));
+}
+function resolveOkfAuthoringVersion(requested) {
+  const version2 = requested ?? DEFAULT_OKF_AUTHORING_VERSION;
+  if (!SUPPORTED_OKF_AUTHORING_VERSIONS.includes(version2)) {
+    throw new InvalidInputError(
+      `Unsupported OKF authoring version '${version2}'. This build can author ${SUPPORTED_OKF_AUTHORING_VERSIONS.join(" and ")}; bundles declaring other versions can still be read or transported.`
+    );
+  }
+  return version2;
+}
+async function initBundle(root, options2 = {}) {
+  const okfVersion = resolveOkfAuthoringVersion(options2.okfVersion);
+  const resolved = path4.resolve(root);
+  const backend = new FilesystemBackend(resolved);
+  if (options2.expectNew || await backend.readReserved("", "index.md") === null) {
+    const name = path4.basename(resolved);
+    const body = `${GENERATED_INDEX_MARKER}
+# ${name}
+
+An Open Knowledge Format bundle.
+`;
+    try {
+      await backend.writeReserved("", "index.md", stringifyWithData({ okf_version: okfVersion }, body), {
+        expectedVersion: null
+      });
+    } catch (err) {
+      if (options2.expectNew || !(err instanceof VersionConflict)) throw err;
+    }
+  }
+  return { root: resolved };
+}
+async function writeDocVersionedForEdition2(bundle, doc2, okfVersion, options2) {
+  return writeDocVersionedForEdition(backendFor(bundle), doc2, okfVersion, options2);
+}
+async function readDocVersioned2(bundle, id) {
+  return readDocVersioned(backendFor(bundle), id);
+}
+async function readDoc2(bundle, id) {
+  return readDoc(backendFor(bundle), id);
+}
+async function existsDoc2(bundle, id) {
+  return existsDoc(backendFor(bundle), id);
+}
+async function docVersions2(bundle, id) {
+  return docVersions(backendFor(bundle), id);
 }
-async function readBlob(bundle, key) {
-  return backendFor(bundle).readBlob(key);
+async function deleteDoc2(bundle, id, options2) {
+  return deleteDoc(backendFor(bundle), id, options2);
 }
-async function writeBlob(bundle, key, bytes, contentType, options2) {
-  return backendFor(bundle).writeBlob(key, bytes, contentType, options2);
+async function query2(bundle, filter = {}, options2 = {}) {
+  return query(backendFor(bundle), filter, options2);
 }
-async function listBlobs(bundle, prefix) {
-  return backendFor(bundle).listBlobs(prefix);
+async function queryHeads2(bundle, filter = {}, options2 = {}) {
+  return queryHeads(backendFor(bundle), filter, options2);
 }
-async function deleteBlob(bundle, key, options2) {
-  return backendFor(bundle).deleteBlob(key, options2);
+function parseLinks2(_bundle, doc2) {
+  return parseLinks(doc2);
 }
-var SUPPORTED_OKF_AUTHORING_VERSIONS, DEFAULT_OKF_AUTHORING_VERSION, isEnoent;
+async function queryEdges2(bundle, filter = {}) {
+  return queryEdges(backendFor(bundle), filter);
+}
+async function backlinks2(bundle, target) {
+  return backlinks(backendFor(bundle), target);
+}
+async function readBlob2(bundle, key) {
+  return readBlob(backendFor(bundle), key);
+}
+async function writeBlob2(bundle, key, bytes, contentType, options2) {
+  return writeBlob(backendFor(bundle), key, bytes, contentType, options2);
+}
+async function listBlobs2(bundle, prefix) {
+  return listBlobs(backendFor(bundle), prefix);
+}
+async function deleteBlob2(bundle, key, options2) {
+  return deleteBlob(backendFor(bundle), key, options2);
+}
+var SUPPORTED_OKF_AUTHORING_VERSIONS, DEFAULT_OKF_AUTHORING_VERSION;
 var init_bundle = __esm({
   "../core/src/bundle.ts"() {
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
     init_backend();
-    init_document_write_policy();
+    init_engine();
+    init_errors();
     init_frontmatter();
     init_index_marker();
-    init_links();
-    init_paths();
-    init_errors();
-    init_query_filter();
     init_versioning();
     SUPPORTED_OKF_AUTHORING_VERSIONS = ["0.1", "0.2"];
     DEFAULT_OKF_AUTHORING_VERSION = "0.2";
-    isEnoent = (err) => err?.code === "ENOENT";
   }
 });
 
@@ -6176,6 +6341,11 @@ function retryDelayMs(attempt) {
 function delay2(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
 function encodeId(id) {
   return id.split("/").map((seg) => encodeURIComponent(seg)).join("/");
 }
@@ -6191,7 +6361,7 @@ var init_remote_backend = __esm({
     init_content_type();
     init_errors();
     init_paths();
-    init_versioning();
+    init_version_transport();
     RemoteError = class extends Error {
       /** The envelope's `code` field, or a status-derived guess when the envelope is missing/unparseable. */
       code;
@@ -6215,7 +6385,7 @@ var init_remote_backend = __esm({
       authToken;
       maxRetries;
       constructor(options2) {
-        this.baseUrl = options2.baseUrl.replace(/\/+$/, "");
+        this.baseUrl = trimTrailingSlashes(options2.baseUrl);
         this.bundle = options2.bundle;
         this.fetchImpl = options2.fetchImpl ?? ((request) => globalThis.fetch(request));
         this.authToken = options2.authToken;
@@ -7376,7 +7546,7 @@ var init_kinds = __esm({
       ["owner_field", "ownerField"],
       ["state_field", "stateField"]
     ];
-    H1_RE = /^#\s+(.+?)\s*$/gm;
+    H1_RE = /^#\s+(\S.*)$/gm;
     HORIZON_RE = /^(\d+)(m|h|d)$/;
     HORIZON_UNIT_MS = { m: 6e4, h: 36e5, d: 864e5 };
   }
@@ -7493,7 +7663,7 @@ async function mutateDocument(opts) {
   const compareTimestamp = opts.compareTimestamp ?? false;
   const persistActor = opts.persistActor ?? false;
   const seedClock = opts.seedGenerationClock ?? true;
-  const okfVersion = await readBundleOkfVersion(opts.bundle) ?? "0.1";
+  const okfVersion = await readBundleOkfVersion2(opts.bundle) ?? "0.1";
   if (okfVersion !== "0.1" && okfVersion !== "0.2") {
     throw new InvalidInputError(
       `Unsupported OKF mutation version '${okfVersion}'. This build can mutate 0.1 and 0.2 bundles.`
@@ -7517,7 +7687,7 @@ async function mutateDocument(opts) {
     );
     const candidate = withV02Metadata(attributed, void 0, okfVersion, opts.registry, decisionNow, seedClock);
     const { warnings } = validateCandidate(opts.id, candidate, opts.registry, opts.strict, okfVersion, decisionNow);
-    const { doc: doc2, version: version2 } = await writeDocVersionedForEdition(opts.bundle, { id: opts.id, ...candidate }, okfVersion, {
+    const { doc: doc2, version: version2 } = await writeDocVersionedForEdition2(opts.bundle, { id: opts.id, ...candidate }, okfVersion, {
       expectedVersion: null,
       actor: opts.actor
     });
@@ -7526,7 +7696,7 @@ async function mutateDocument(opts) {
   let lastReadVersion = null;
   const readExisting = async () => {
     try {
-      const { doc: doc2, version: version2 } = await readDocVersioned(opts.bundle, opts.id);
+      const { doc: doc2, version: version2 } = await readDocVersioned2(opts.bundle, opts.id);
       lastReadVersion = version2;
       return { state: doc2, version: version2 };
     } catch (error51) {
@@ -7578,7 +7748,7 @@ async function mutateDocument(opts) {
         return { action: "write", next: { id: opts.id, ...candidate }, result: {} };
       },
       write: async (next, expectedVersion) => {
-        const written = await writeDocVersionedForEdition(opts.bundle, next, okfVersion, {
+        const written = await writeDocVersionedForEdition2(opts.bundle, next, okfVersion, {
           expectedVersion,
           actor: opts.actor
         });
@@ -7634,7 +7804,7 @@ async function mutateDocument(opts) {
       return { action: "write", next: { id: opts.id, ...candidate }, result: { warnings } };
     },
     write: async (next, expectedVersion) => {
-      const written = await writeDocVersionedForEdition(opts.bundle, next, okfVersion, {
+      const written = await writeDocVersionedForEdition2(opts.bundle, next, okfVersion, {
         expectedVersion: hardCas ? opts.expectedVersion : expectedVersion,
         actor: opts.actor
       });
@@ -7963,7 +8133,7 @@ var init_index_projection = __esm({
 // ../core/src/kinds-load.ts
 async function loadKinds(bundle) {
   const warnings = [];
-  const docs = await query(bundle, { prefix: CONVENTIONS_PREFIX, type: CONVENTION_TYPE }, {
+  const docs = await query2(bundle, { prefix: CONVENTIONS_PREFIX, type: CONVENTION_TYPE }, {
     onSkip: ({ id, reason }) => warnings.push({
       code: "KIND_CONVENTION_MALFORMED",
       message: `skipped kind convention '${id}' with unparseable frontmatter: ${reason}`,
@@ -8027,6 +8197,34 @@ function firstGitLine(f2) {
   const line2 = f2.stderr.split("\n").find((l) => l.trim().length > 0) ?? f2.stdout.split("\n").find((l) => l.trim().length > 0) ?? "";
   return line2.trim();
 }
+function hasRejectedReason(text4, reasons) {
+  for (const line2 of text4.split("\n")) {
+    const lower = line2.toLowerCase();
+    const marker = lower.indexOf("[rejected]");
+    if (marker === -1) continue;
+    if (reasons.some((reason) => lower.indexOf(`(${reason.toLowerCase()})`, marker) !== -1)) return true;
+  }
+  return false;
+}
+function hasUnmergeableOriginRef(text4) {
+  const suffix = " - not something we can merge";
+  for (const line2 of text4.split("\n")) {
+    const lower = line2.toLowerCase();
+    const at = lower.indexOf(suffix);
+    if (at <= 0) continue;
+    const ref = lower.slice(0, at);
+    let runStart = 0;
+    for (let i = ref.length - 1; i >= 0; i -= 1) {
+      if (/\s/.test(ref[i])) {
+        runStart = i + 1;
+        break;
+      }
+    }
+    const start = ref.indexOf("origin/", runStart);
+    if (start !== -1 && ref.length - start > "origin/".length) return true;
+  }
+  return false;
+}
 function classifyGitError(f2) {
   const op = f2.args[0] ?? "git";
   const text4 = `${f2.stderr}
@@ -8049,14 +8247,14 @@ ${f2.stdout}`;
       { details: { op, retryable: true } }
     );
   }
-  if (op === "push" && (/\[rejected\].*\((?:fetch first|non-fast-forward)\)/i.test(text4) || /Updates were rejected because (?:the remote contains work|the tip of your current branch is behind)/i.test(text4))) {
+  if (op === "push" && (hasRejectedReason(text4, ["fetch first", "non-fast-forward"]) || /Updates were rejected because (?:the remote contains work|the tip of your current branch is behind)/i.test(text4))) {
     return new BoardGitError(
       "TRANSIENT",
       "a teammate pushed to the board at the same time \u2014 re-run sync to incorporate their changes and retry",
       { details: { op, retryable: true, reason: "non-fast-forward" } }
     );
   }
-  if (/'origin' does not appear to be a git repository/i.test(text4) || /No such remote:? '?origin'?/i.test(text4) || /invalid upstream ['"]?origin\//i.test(text4) || /origin\/[^\s]+ - not something we can merge/i.test(text4) || /couldn'?t find remote ref/i.test(text4) || /src refspec [^\s]+ does not match any/i.test(text4)) {
+  if (/'origin' does not appear to be a git repository/i.test(text4) || /No such remote:? '?origin'?/i.test(text4) || /invalid upstream ['"]?origin\//i.test(text4) || hasUnmergeableOriginRef(text4) || /couldn'?t find remote ref/i.test(text4) || /src refspec [^\s]+ does not match any/i.test(text4)) {
     return new BoardGitError(
       "NO_UPSTREAM",
       "the board branch isn't linked to a remote yet \u2014 sync can't share it",
@@ -8122,6 +8320,18 @@ var init_errors2 = __esm({
   }
 });
 
+// ../board-git/src/git-path.ts
+function normalizeGitLexicalPath(gitPath, dialect) {
+  return dialect.normalize(gitPath);
+}
+var init_git_path = __esm({
+  "../board-git/src/git-path.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+  }
+});
+
 // ../board-git/src/porcelain.ts
 import { spawnSync } from "node:child_process";
 import {
@@ -8253,7 +8463,12 @@ function mustGit(dir, args, opts = {}) {
   return r2.stdout;
 }
 function slugifyActor(actor) {
-  const slug = actor.toLowerCase().replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "");
+  const collapsed = actor.toLowerCase().replace(/[^a-z0-9.-]+/g, "-");
+  let start = 0;
+  let end = collapsed.length;
+  while (start < end && collapsed[start] === "-") start += 1;
+  while (end > start && collapsed[end - 1] === "-") end -= 1;
+  const slug = collapsed.slice(start, end);
   return slug.length > 0 ? slug : IDENTITY_FALLBACK_ACTOR;
 }
 function hasResolvableIdentity(dir) {
@@ -8287,7 +8502,7 @@ function probeRepoTopLevel(dir) {
     };
   }
   const top = r2.stdout.trim();
-  return top.length > 0 ? { kind: "repo", top } : { kind: "unavailable", reason: "git repository discovery returned an empty top level" };
+  return top.length > 0 ? { kind: "repo", top: normalizeGitLexicalPath(top, path5) } : { kind: "unavailable", reason: "git repository discovery returned an empty top level" };
 }
 function repoTopLevel(dir) {
   const result3 = probeRepoTopLevel(dir);
@@ -9179,6 +9394,7 @@ var init_porcelain = __esm({
     init_define_SUPERBEE_UPDATE_POLICY();
     init_src();
     init_errors2();
+    init_git_path();
     BOARD_BRANCH = "board";
     BOARD_REMOTE = "origin";
     BOARD_REF = `${BOARD_REMOTE}/${BOARD_BRANCH}`;
@@ -9530,13 +9746,25 @@ var init_diff = __esm({
 import { readFile } from "node:fs/promises";
 import { createHash as createHash5 } from "node:crypto";
 import { basename, join as join3, resolve } from "node:path";
+function trimTrailing(value, char) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === char) end -= 1;
+  return value.slice(0, end);
+}
+function trimLeading(value, char) {
+  let start = 0;
+  while (start < value.length && value[start] === char) start += 1;
+  return value.slice(start);
+}
 function normalizeRemoteUrl(url2) {
-  let u2 = url2.trim().replace(/\/+$/, "");
+  let u2 = trimTrailing(url2.trim(), "/");
   if (u2.endsWith(".git")) u2 = u2.slice(0, -".git".length);
   return u2;
 }
 function normalizeSubpath(subpath) {
-  return subpath.trim().replace(/^\.\//, "").replace(/^\/+/, "").replace(/\/+$/, "");
+  const trimmed = subpath.trim();
+  const relative2 = trimmed.startsWith("./") ? trimmed.slice(2) : trimmed;
+  return trimTrailing(trimLeading(relative2, "/"), "/");
 }
 function bundleKey(src) {
   if ("remoteUrl" in src) {
@@ -9878,7 +10106,7 @@ function provisionAnnouncement(outcome) {
   }
   return Object.keys(announcement).length > 0 ? announcement : void 0;
 }
-var init_engine = __esm({
+var init_engine2 = __esm({
   "../board-git/src/engine.ts"() {
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
@@ -10007,7 +10235,7 @@ var init_autopull = __esm({
     init_define_SUPERBEE_UPDATE_POLICY();
     init_porcelain();
     init_diff();
-    init_engine();
+    init_engine2();
     AUTO_PULL_STALE_MS = 5 * 6e4;
     AUTO_PULL_BUDGET_MS = 2e3;
     AUTO_PULL_CONNECT_TIMEOUT_SECONDS = 2;
@@ -10131,7 +10359,7 @@ var init_intree = __esm({
     init_porcelain();
     init_diff();
     init_errors2();
-    init_engine();
+    init_engine2();
     IN_TREE_CURSOR_TIER = "git-intree";
   }
 });
@@ -10147,7 +10375,7 @@ var init_src2 = __esm({
     init_channel();
     init_diff();
     init_cursor();
-    init_engine();
+    init_engine2();
     init_flow();
     init_autopull();
     init_intree();
@@ -10583,15 +10811,8 @@ async function inspectUserStateMarker(root, input) {
 async function hasExactUserStateMarker(root, input) {
   return (await inspectUserStateMarker(root, input)).recognized;
 }
-async function writeFileAtomic0600(dir, fileName2, content3, options2 = {}, input) {
+async function publishFileAtomic0600(dir, fileName2, content3, options2 = {}, input) {
   const policy = resolveUserStatePolicy(input);
-  try {
-    await mkdir(dir, { recursive: true, mode: DIR_MODE });
-  } catch (error51) {
-    if (errno(error51) !== "EEXIST") throw error51;
-  }
-  await assertRealDirectory(dir);
-  if (policy.containment === "posix-owner-mode") await chmod(dir, DIR_MODE);
   const file2 = join4(dir, fileName2);
   const temporary = join4(dir, `.${fileName2}.${randomBytes(8).toString("hex")}.tmp`);
   const handle = await open(temporary, "wx", FILE_MODE);
@@ -10613,6 +10834,17 @@ async function writeFileAtomic0600(dir, fileName2, content3, options2 = {}, inpu
     throw error51;
   }
 }
+async function writeFileAtomic0600(dir, fileName2, content3, options2 = {}, input) {
+  const policy = resolveUserStatePolicy(input);
+  try {
+    await mkdir(dir, { recursive: true, mode: DIR_MODE });
+  } catch (error51) {
+    if (errno(error51) !== "EEXIST") throw error51;
+  }
+  await assertRealDirectory(dir);
+  if (policy.containment === "posix-owner-mode") await chmod(dir, DIR_MODE);
+  await publishFileAtomic0600(dir, fileName2, content3, options2, input);
+}
 async function ensureStateRootGitignore(root, input) {
   try {
     if (await readPrivateStateFile(join4(root, STATE_ROOT_GITIGNORE_FILE_NAME), 64, void 0, input) === STATE_ROOT_GITIGNORE_BYTES) return;
@@ -10623,10 +10855,7 @@ async function ensureStateRootGitignore(root, input) {
   } catch {
   }
 }
-async function initializeCanonicalRoot(root, input) {
-  const policy = resolveUserStatePolicy(input);
-  const parent = dirname3(root);
-  await ensureParentDirectory(parent);
+async function publishCanonicalRoot(root, input, hooks) {
   let created = false;
   try {
     await mkdir(root, { mode: DIR_MODE });
@@ -10637,6 +10866,7 @@ async function initializeCanonicalRoot(root, input) {
   await assertRealDirectory(root);
   if (created) {
     try {
+      await hooks.beforeMarkerPublication?.();
       await writeFileAtomic0600(root, USER_STATE_MARKER_FILE_NAME, USER_STATE_MARKER_BYTES, {}, input);
     } catch (error51) {
       await rmdir(root).catch(() => {
@@ -10644,11 +10874,17 @@ async function initializeCanonicalRoot(root, input) {
       throw error51;
     }
   }
-  if (!created) {
-    for (let attempt = 0; attempt < 50 && !await hasExactUserStateMarker(root, input); attempt += 1) {
-      await new Promise((resolve2) => setTimeout(resolve2, 5));
-    }
+  const marker = await inspectUserStateMarker(root, input);
+  if (!marker.recognized) {
+    throw new Error("canonical Superbee user-state root is not owned by this product");
   }
+}
+async function initializeCanonicalRoot(root, input, hooks = {}) {
+  const policy = resolveUserStatePolicy(input);
+  const parent = dirname3(root);
+  await ensureParentDirectory(parent);
+  const lockOptions = hooks.lockRoot === void 0 ? { portableRoot: root } : { portableRoot: root, lockRoot: hooks.lockRoot };
+  await withFilesystemMutationLock(root, () => publishCanonicalRoot(root, input, hooks), lockOptions);
   const marker = await inspectUserStateMarker(root, input);
   if (!marker.recognized) {
     throw new Error("canonical Superbee user-state root is not owned by this product");
@@ -10711,6 +10947,21 @@ async function inspectCanonicalUserStateRootDetail(input = homedir3()) {
 async function inspectCanonicalUserStateRoot(input = homedir3()) {
   return (await inspectCanonicalUserStateRootDetail(input)).state;
 }
+async function assertCanonicalUserStateRootReady(input) {
+  if (await inspectCanonicalUserStateRoot(input) !== "ready") {
+    throw new Error("canonical Superbee user-state root is not owned by this product");
+  }
+}
+async function writeReadyUserStateFileAtomic0600(input, fileName2, content3) {
+  const root = canonicalUserStateDir(input);
+  await assertCanonicalUserStateRootReady(input);
+  await publishFileAtomic0600(root, fileName2, content3, {
+    beforeCommit: async () => {
+      await assertCanonicalUserStateRootReady(input);
+      return true;
+    }
+  }, input);
+}
 function missingStateError(file2) {
   return Object.assign(new Error("private user-state record is absent"), { code: "ENOENT", path: file2 });
 }
@@ -10954,6 +11205,7 @@ var init_user_state = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_src();
     init_build_identity();
     SUPERBEE_USER_STATE_PATH_SEGMENTS = Object.freeze([".superbee-state"]);
     SUPERSEDED_USER_STATE_PATH_SEGMENTS = Object.freeze([
@@ -12941,6 +13193,18 @@ var init_managed_authority = __esm({
   }
 });
 
+// ../core/src/storage.ts
+var init_storage = __esm({
+  "../core/src/storage.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_errors();
+    init_paths();
+    init_version_transport();
+  }
+});
+
 // ../server/src/router.ts
 function isEnoent2(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
@@ -12981,14 +13245,14 @@ function errorFromCaught(err) {
     return errorResponse(412, "VERSION_CONFLICT", err.message, { expected: err.expected, actual: err.actual });
   }
   if (isEnoent2(err)) {
-    return errorResponse(404, "NOT_FOUND", err instanceof Error ? err.message : "not found");
+    return errorResponse(404, "NOT_FOUND", "document or blob not found");
   }
   if (err instanceof InvalidInputError) {
     return errorResponse(400, "USAGE", err.message);
   }
-  return errorResponse(500, "RUNTIME", err instanceof Error ? err.message : String(err));
+  return errorResponse(500, "RUNTIME", "internal server error");
 }
-function writeOptionsFromHeaders(req) {
+function writeOptionsFromRequest(req, attribution) {
   const options2 = {};
   if (req.headers.get("If-None-Match") === "*") {
     options2.expectedVersion = null;
@@ -12996,10 +13260,8 @@ function writeOptionsFromHeaders(req) {
     const ifMatch = req.headers.get("If-Match");
     if (ifMatch !== null) options2.expectedVersion = stripETagWrapper(ifMatch);
   }
-  const actor = req.headers.get("X-Actor");
-  if (actor) options2.actor = actor;
-  const agent = req.headers.get("X-Agent");
-  if (agent) options2.agent = agent;
+  options2.actor = attribution.actor;
+  if (attribution.agent !== void 0) options2.agent = attribution.agent;
   return options2;
 }
 function deleteOptionsFromHeaders(req) {
@@ -13009,37 +13271,136 @@ function deleteOptionsFromHeaders(req) {
 function versionHeaders(version2) {
   return { "X-Version": version2, ETag: `"${version2}"` };
 }
-function matchWireResources(pathname) {
-  if (pathname === "/v0/capabilities") return [{ resource: "capabilities" }];
-  const match = BUNDLE_PATH_RE.exec(pathname);
-  if (!match) return [];
-  const rest = match[2] ?? "";
-  if (rest === "docs") return [{ resource: "docs" }];
-  if (rest === "docs:read-many") return [{ resource: "docs-read-many" }];
-  if (rest.startsWith("docs/")) {
-    const tail = rest.slice("docs/".length);
-    return tail.endsWith("/versions") ? [
-      { resource: "doc-versions", value: tail.slice(0, -"/versions".length) },
-      { resource: "doc", value: tail }
-    ] : [{ resource: "doc", value: tail }];
-  }
-  if (rest.startsWith("reserved/")) {
-    return [{ resource: "reserved", value: rest.slice("reserved/".length) }];
-  }
-  if (rest === "blobs") return [{ resource: "blobs" }];
-  if (rest.startsWith("blobs/")) return [{ resource: "blob", value: rest.slice("blobs/".length) }];
-  return [];
+function isCanonicalBundleId(value) {
+  return BUNDLE_ID_RE.test(value);
+}
+function literalSpecificity(path41) {
+  return path41.split("/").filter((segment) => segment !== "" && !segment.startsWith("{")).length;
+}
+function matchTemplate(template, pathname) {
+  const templateSegments = template.split("/");
+  const pathSegments = pathname.split("/");
+  const params = {};
+  let pathIndex = 0;
+  for (let templateIndex = 0; templateIndex < templateSegments.length; templateIndex++, pathIndex++) {
+    const expected = templateSegments[templateIndex];
+    const actual = pathSegments[pathIndex];
+    if (expected.startsWith("{") && expected.endsWith("...}")) {
+      const suffixLength = templateSegments.length - templateIndex - 1;
+      const captureEnd = pathSegments.length - suffixLength;
+      if (actual === void 0 || actual === "" || captureEnd <= pathIndex) return void 0;
+      params[expected.slice(1, -4)] = pathSegments.slice(pathIndex, captureEnd).join("/");
+      pathIndex = captureEnd - 1;
+      continue;
+    }
+    if (actual === void 0) return void 0;
+    if (expected.startsWith("{") && expected.endsWith("}")) {
+      if (actual === "") return void 0;
+      params[expected.slice(1, -1)] = actual;
+    } else if (expected !== actual) {
+      return void 0;
+    }
+  }
+  return pathIndex === pathSegments.length ? params : void 0;
+}
+function resourceFromMatch(resource, params, searchParams) {
+  switch (resource) {
+    case "capabilities":
+      return { kind: "capabilities" };
+    case "docs":
+      return { kind: "docs" };
+    case "docs-read-many":
+      return { kind: "docs-read-many" };
+    case "doc": {
+      const id = decodeId(params.id);
+      assertValidDocId(id);
+      return { kind: "doc", id };
+    }
+    case "doc-versions": {
+      const id = decodeId(params.id);
+      assertValidDocId(id);
+      return { kind: "doc-versions", id };
+    }
+    case "reserved": {
+      const name = params.name;
+      if (name !== "index.md" && name !== "log.md") {
+        throw new InvalidInputError(`reserved file name must be index.md or log.md, got '${name}'`);
+      }
+      const dir = searchParams.get("dir") ?? "";
+      assertSafeReservedDir(dir);
+      return { kind: "reserved", dir, name };
+    }
+    case "blobs":
+      return { kind: "blobs" };
+    case "blob": {
+      const key = decodeBlobKey(params.key);
+      assertSafeBlobKey(key);
+      return { kind: "blob", key };
+    }
+  }
 }
-function resolveWireEndpoint(resources, method) {
-  for (const match of resources) {
-    const endpoint = WIRE_ENDPOINTS.find((row2) => row2.resource === match.resource && row2.method === method);
-    if (endpoint) return { endpoint, match };
+function invalidBundleFromPath(pathname) {
+  const prefix = "/v0/bundles/";
+  if (!pathname.startsWith(prefix)) return void 0;
+  const rawBundle = pathname.slice(prefix.length).split("/", 1)[0] ?? "";
+  if (!isCanonicalBundleId(rawBundle)) {
+    return new WireRequestResolutionError(400, "USAGE", `invalid bundle id '${rawBundle}'`);
   }
   return void 0;
 }
-function unsupportedMethodResponse(method, match) {
+function resolvePathAndMethod(pathname, searchParams, method) {
+  const bundleError = invalidBundleFromPath(pathname);
+  if (bundleError) throw bundleError;
+  const shapeMatches = WIRE_ENDPOINTS.flatMap((endpoint) => {
+    const params = matchTemplate(endpoint.path, pathname);
+    return params ? [{ endpoint, params }] : [];
+  });
+  if (shapeMatches.length === 0) {
+    throw new WireRequestResolutionError(404, "NOT_FOUND", `no route for ${pathname}`);
+  }
+  const methodMatches = shapeMatches.filter(({ endpoint }) => endpoint.method === method).sort((a, b) => literalSpecificity(b.endpoint.path) - literalSpecificity(a.endpoint.path));
+  const selected = methodMatches[0];
+  if (!selected) {
+    throw new WireRequestResolutionError(
+      400,
+      "USAGE",
+      `unsupported method ${method} for ${routeLabel(shapeMatches[0].endpoint.resource)}`
+    );
+  }
+  try {
+    const resource = resourceFromMatch(selected.endpoint.resource, selected.params, searchParams);
+    if (selected.endpoint.id === "capabilities") {
+      return {
+        scope: "deployment",
+        endpointId: "capabilities",
+        accessClass: "public",
+        resource: { kind: "capabilities" },
+        searchParams
+      };
+    }
+    const bundleId = selected.params.bundle;
+    if (!isCanonicalBundleId(bundleId)) {
+      throw new WireRequestResolutionError(400, "USAGE", `invalid bundle id '${bundleId}'`);
+    }
+    return {
+      scope: "bundle",
+      bundleId,
+      endpointId: selected.endpoint.id,
+      accessClass: selected.endpoint.accessClass,
+      resource,
+      searchParams
+    };
+  } catch (error51) {
+    if (error51 instanceof WireRequestResolutionError) throw error51;
+    if (error51 instanceof InvalidInputError) {
+      throw new WireRequestResolutionError(400, "USAGE", error51.message);
+    }
+    throw error51;
+  }
+}
+function routeLabel(resource) {
   let label;
-  switch (match.resource) {
+  switch (resource) {
     case "docs":
       label = "/docs";
       break;
@@ -13063,33 +13424,45 @@ function unsupportedMethodResponse(method, match) {
       label = "/v0/capabilities";
       break;
   }
-  return errorResponse(400, "USAGE", `unsupported method ${method} for ${label}`);
+  return label;
+}
+function responseForMethod(isHead, response) {
+  if (!isHead) return response;
+  return new Response(null, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
 }
 function registeredWireRouter(dispatch) {
   return async function handle(req) {
+    const isHead = req.method === "HEAD";
+    let response;
     let url2;
     try {
-      url2 = new URL(req.url);
-    } catch {
-      return errorResponse(400, "USAGE", "invalid request URL");
-    }
-    const resources = matchWireResources(url2.pathname);
-    if (resources.length === 0) return errorResponse(404, "NOT_FOUND", `no route for ${url2.pathname}`);
-    const resolved = resolveWireEndpoint(resources, req.method);
-    if (!resolved) return unsupportedMethodResponse(req.method, resources[0]);
-    try {
-      return await dispatch(req, { ...resolved, searchParams: url2.searchParams });
+      try {
+        url2 = new URL(req.url);
+      } catch {
+        throw new WireRequestResolutionError(400, "USAGE", "invalid request URL");
+      }
+      const resolved = resolvePathAndMethod(url2.pathname, url2.searchParams, req.method);
+      response = await dispatch(req, { resolved });
     } catch (err) {
-      return errorFromCaught(err);
+      if (err instanceof WireRequestResolutionError) {
+        const message = err.status === 404 ? `no route for ${url2.pathname}` : err.message;
+        response = errorResponse(err.status, err.code, message);
+      } else {
+        response = errorFromCaught(err);
+      }
     }
+    return responseForMethod(isHead, response);
   };
 }
-function createRouter(bundle) {
-  return buildRouter(bundle.backend ?? new FilesystemBackend(bundle.root));
+function createRouter(options2) {
+  return buildRouter(options2);
 }
-function buildRouter(backend) {
-  const bundle = { root: "", backend };
-  async function handleReadDoc(id) {
+function buildRouter(options2) {
+  async function handleReadDoc(backend, id) {
     assertValidDocId(id);
     try {
       const { doc: doc2, version: version2 } = await backend.read(id);
@@ -13099,7 +13472,7 @@ function buildRouter(backend) {
       throw err;
     }
   }
-  async function handleHeadDoc(id) {
+  async function handleHeadDoc(backend, id) {
     try {
       assertValidDocId(id);
     } catch {
@@ -13113,7 +13486,7 @@ function buildRouter(backend) {
       throw err;
     }
   }
-  async function handleWriteDoc(id, req) {
+  async function handleWriteDoc(backend, attribution, id, req) {
     let payload;
     try {
       payload = await req.json();
@@ -13126,27 +13499,27 @@ function buildRouter(backend) {
     if (payload.body !== void 0 && typeof payload.body !== "string") {
       return errorResponse(400, "USAGE", "request body field body must be a string when present");
     }
-    const options2 = writeOptionsFromHeaders(req);
+    const writeOptions = writeOptionsFromRequest(req, attribution);
     const result3 = await writeDocVersioned(
-      bundle,
+      backend,
       { id, frontmatter: payload.frontmatter, body: payload.body ?? "" },
-      options2
+      writeOptions
     );
-    const status2 = options2.expectedVersion === null ? 201 : 200;
+    const status2 = writeOptions.expectedVersion === null ? 201 : 200;
     return jsonResponse(status2, { version: result3.version }, versionHeaders(result3.version));
   }
-  async function handleDeleteDoc(id, req) {
+  async function handleDeleteDoc(backend, id, req) {
     assertValidDocId(id);
-    const options2 = deleteOptionsFromHeaders(req);
-    const deleted = await backend.delete(id, options2);
+    const options3 = deleteOptionsFromHeaders(req);
+    const deleted = await backend.delete(id, options3);
     return jsonResponse(200, { deleted });
   }
-  async function handleVersions(id) {
+  async function handleVersions(backend, id) {
     assertValidDocId(id);
     const history = await backend.versions(id);
     return jsonResponse(200, { versions: history });
   }
-  async function handleReadMany(req) {
+  async function handleReadMany(backend, req) {
     let payload;
     try {
       payload = await req.json();
@@ -13161,8 +13534,8 @@ function buildRouter(backend) {
     for (const id of ids) {
       try {
         assertValidDocId(id);
-      } catch (err) {
-        return errorResponse(400, "USAGE", err instanceof Error ? err.message : `invalid id '${id}'`, { id });
+      } catch {
+        return errorResponse(400, "USAGE", `invalid document id '${id}'`, { id });
       }
     }
     const existsFlags = await Promise.all(ids.map((id) => backend.exists(id)));
@@ -13175,7 +13548,7 @@ function buildRouter(backend) {
       results: results.map((r2) => ({ id: r2.doc.id, frontmatter: r2.doc.frontmatter, body: r2.doc.body, version: r2.version }))
     });
   }
-  async function handleList(searchParams) {
+  async function handleList(backend, searchParams) {
     const prefix = searchParams.get("prefix") ?? void 0;
     const type = searchParams.get("type") ?? void 0;
     const tags = searchParams.getAll("tag");
@@ -13184,7 +13557,7 @@ function buildRouter(backend) {
     const parsedLimit = limitParam ? parseInt(limitParam, 10) : NaN;
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : DEFAULT_LIST_LIMIT;
     const cursor = searchParams.get("cursor") ?? void 0;
-    const heads = await queryHeads(bundle, { prefix, type, tags });
+    const heads = await queryHeads(backend, { prefix, type, tags });
     const count = heads.length;
     let page = heads;
     if (cursor) {
@@ -13204,13 +13577,13 @@ function buildRouter(backend) {
     );
     return jsonResponse(200, { count, docs, next_cursor: nextCursor });
   }
-  async function handleReadReserved(dir, name) {
+  async function handleReadReserved(backend, dir, name) {
     assertSafeReservedDir(dir);
     const result3 = await backend.readReserved(dir, name);
     if (result3 === null) return errorResponse(404, "NOT_FOUND", `no reserved file '${name}' at dir '${dir}'`);
     return jsonResponse(200, { content: result3.content }, versionHeaders(result3.version));
   }
-  async function handleWriteReserved(dir, name, req) {
+  async function handleWriteReserved(backend, attribution, dir, name, req) {
     assertSafeReservedDir(dir);
     let payload;
     try {
@@ -13221,12 +13594,12 @@ function buildRouter(backend) {
     if (typeof payload.content !== "string") {
       return errorResponse(400, "USAGE", "request body must include a content: string field");
     }
-    const options2 = writeOptionsFromHeaders(req);
-    const version2 = await backend.writeReserved(dir, name, payload.content, options2);
-    const status2 = options2.expectedVersion === null ? 201 : 200;
+    const writeOptions = writeOptionsFromRequest(req, attribution);
+    const version2 = await backend.writeReserved(dir, name, payload.content, writeOptions);
+    const status2 = writeOptions.expectedVersion === null ? 201 : 200;
     return jsonResponse(status2, { version: version2 }, versionHeaders(version2));
   }
-  async function handleReadBlob(key) {
+  async function handleReadBlob(backend, key) {
     assertSafeBlobKey(key);
     const result3 = await backend.readBlob(key);
     if (result3 === null) return errorResponse(404, "NOT_FOUND", `no blob '${key}'`);
@@ -13235,7 +13608,7 @@ function buildRouter(backend) {
       headers: { "content-type": result3.contentType, ...versionHeaders(result3.version) }
     });
   }
-  async function handleHeadBlob(key) {
+  async function handleHeadBlob(backend, key) {
     try {
       assertSafeBlobKey(key);
     } catch {
@@ -13248,23 +13621,23 @@ function buildRouter(backend) {
       headers: { "content-type": result3.contentType, ...versionHeaders(result3.version) }
     });
   }
-  async function handleWriteBlob(key, req) {
+  async function handleWriteBlob(backend, attribution, key, req) {
     assertSafeBlobKey(key);
     const bytes = new Uint8Array(await req.arrayBuffer());
     const contentTypeHeader = req.headers.get("content-type");
     const contentType = contentTypeHeader && contentTypeHeader.trim() !== "" ? contentTypeHeader : void 0;
-    const options2 = writeOptionsFromHeaders(req);
-    const version2 = await backend.writeBlob(key, bytes, contentType, options2);
-    const status2 = options2.expectedVersion === null ? 201 : 200;
+    const writeOptions = writeOptionsFromRequest(req, attribution);
+    const version2 = await backend.writeBlob(key, bytes, contentType, writeOptions);
+    const status2 = writeOptions.expectedVersion === null ? 201 : 200;
     return jsonResponse(status2, { version: version2 }, versionHeaders(version2));
   }
-  async function handleDeleteBlob(key, req) {
+  async function handleDeleteBlob(backend, key, req) {
     assertSafeBlobKey(key);
-    const options2 = deleteOptionsFromHeaders(req);
-    const deleted = await backend.deleteBlob(key, options2);
+    const options3 = deleteOptionsFromHeaders(req);
+    const deleted = await backend.deleteBlob(key, options3);
     return jsonResponse(200, { deleted });
   }
-  async function handleListBlobs(searchParams) {
+  async function handleListBlobs(backend, searchParams) {
     const prefix = searchParams.get("prefix") ?? void 0;
     const limitParam = searchParams.get("limit");
     const parsedLimit = limitParam ? parseInt(limitParam, 10) : NaN;
@@ -13282,15 +13655,7 @@ function buildRouter(backend) {
     return jsonResponse(200, { count, keys: limited, next_cursor: nextCursor });
   }
   function handleCapabilities() {
-    const declared = backend.capabilities?.();
-    const caps = declared ?? {
-      enforced_cas: backend instanceof MemoryBackend,
-      blobs: true,
-      // v0.1 — PUT/GET/HEAD /blobs/{key} + GET /blobs (list)
-      projections: true,
-      backlinks: false
-      // deferred to v1 (docs/WIRE-PROTOCOL.md)
-    };
+    const caps = options2.capabilities;
     return jsonResponse(200, {
       history: caps.history ?? caps.enforced_cas,
       enforced_cas: caps.enforced_cas,
@@ -13299,97 +13664,232 @@ function buildRouter(backend) {
       blobs: caps.blobs
     });
   }
-  return registeredWireRouter(async (req, { endpoint, match, searchParams }) => {
-    switch (endpoint.id) {
+  return registeredWireRouter(async (req, { resolved }) => {
+    if (resolved.scope === "deployment") return handleCapabilities();
+    const context = await options2.resolveContext(req, resolved);
+    if (context instanceof Response) return context;
+    const { backend, attribution } = context;
+    switch (resolved.endpointId) {
       case "capabilities":
-        return handleCapabilities();
+        throw new Error("deployment route reached bundle dispatch");
       case "docs-list":
-        return await handleList(searchParams);
+        return await handleList(backend, resolved.searchParams);
       case "docs-read-many":
-        return await handleReadMany(req);
+        return await handleReadMany(backend, req);
       case "doc-versions":
-        return await handleVersions(decodeId(match.value));
+        return await handleVersions(backend, resolved.resource.id);
       case "doc-read":
-        return await handleReadDoc(decodeId(match.value));
+        return await handleReadDoc(backend, resolved.resource.id);
       case "doc-write":
-        return await handleWriteDoc(decodeId(match.value), req);
+        return await handleWriteDoc(
+          backend,
+          attribution,
+          resolved.resource.id,
+          req
+        );
       case "doc-head":
-        return await handleHeadDoc(decodeId(match.value));
+        return await handleHeadDoc(backend, resolved.resource.id);
       case "doc-delete":
-        return await handleDeleteDoc(decodeId(match.value), req);
-      case "reserved-read":
+        return await handleDeleteDoc(backend, resolved.resource.id, req);
+      case "reserved-read": {
+        const resource = resolved.resource;
+        return await handleReadReserved(backend, resource.dir, resource.name);
+      }
       case "reserved-write": {
-        const name = match.value;
-        if (name !== "index.md" && name !== "log.md") {
-          return errorResponse(400, "USAGE", `reserved file name must be index.md or log.md, got '${name}'`);
-        }
-        const dir = searchParams.get("dir") ?? "";
-        return endpoint.id === "reserved-read" ? await handleReadReserved(dir, name) : await handleWriteReserved(dir, name, req);
+        const resource = resolved.resource;
+        return await handleWriteReserved(backend, attribution, resource.dir, resource.name, req);
       }
       case "blobs-list":
-        return await handleListBlobs(searchParams);
+        return await handleListBlobs(backend, resolved.searchParams);
       case "blob-read":
-        return await handleReadBlob(decodeBlobKey(match.value));
+        return await handleReadBlob(backend, resolved.resource.key);
       case "blob-write":
-        return await handleWriteBlob(decodeBlobKey(match.value), req);
+        return await handleWriteBlob(
+          backend,
+          attribution,
+          resolved.resource.key,
+          req
+        );
       case "blob-head":
-        return await handleHeadBlob(decodeBlobKey(match.value));
+        return await handleHeadBlob(backend, resolved.resource.key);
       case "blob-delete":
-        return await handleDeleteBlob(decodeBlobKey(match.value), req);
+        return await handleDeleteBlob(backend, resolved.resource.key, req);
     }
   });
 }
-var DEFAULT_LIST_LIMIT, BUNDLE_PATH_RE, WIRE_ENDPOINTS;
+var DEFAULT_LIST_LIMIT, WIRE_ENDPOINTS, WireRequestResolutionError, BUNDLE_ID_RE;
 var init_router = __esm({
   "../server/src/router.ts"() {
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
-    init_src();
+    init_storage();
+    init_engine();
     DEFAULT_LIST_LIMIT = 50;
-    BUNDLE_PATH_RE = /^\/v0\/bundles\/([^/]+)\/(.*)$/;
     WIRE_ENDPOINTS = [
-      { id: "capabilities", resource: "capabilities", method: "GET", path: "/v0/capabilities" },
-      { id: "docs-list", resource: "docs", method: "GET", path: "/v0/bundles/{bundle}/docs" },
+      {
+        id: "capabilities",
+        resource: "capabilities",
+        method: "GET",
+        path: "/v0/capabilities",
+        accessClass: "public"
+      },
+      {
+        id: "docs-list",
+        resource: "docs",
+        method: "GET",
+        path: "/v0/bundles/{bundle}/docs",
+        accessClass: "read"
+      },
       {
         id: "docs-read-many",
         resource: "docs-read-many",
         method: "POST",
-        path: "/v0/bundles/{bundle}/docs:read-many"
+        path: "/v0/bundles/{bundle}/docs:read-many",
+        accessClass: "read"
+      },
+      {
+        id: "doc-read",
+        resource: "doc",
+        method: "GET",
+        path: "/v0/bundles/{bundle}/docs/{id...}",
+        accessClass: "read"
+      },
+      {
+        id: "doc-write",
+        resource: "doc",
+        method: "PUT",
+        path: "/v0/bundles/{bundle}/docs/{id...}",
+        accessClass: "write"
+      },
+      {
+        id: "doc-head",
+        resource: "doc",
+        method: "HEAD",
+        path: "/v0/bundles/{bundle}/docs/{id...}",
+        accessClass: "read"
+      },
+      {
+        id: "doc-delete",
+        resource: "doc",
+        method: "DELETE",
+        path: "/v0/bundles/{bundle}/docs/{id...}",
+        accessClass: "write"
       },
-      { id: "doc-read", resource: "doc", method: "GET", path: "/v0/bundles/{bundle}/docs/{id...}" },
-      { id: "doc-write", resource: "doc", method: "PUT", path: "/v0/bundles/{bundle}/docs/{id...}" },
-      { id: "doc-head", resource: "doc", method: "HEAD", path: "/v0/bundles/{bundle}/docs/{id...}" },
-      { id: "doc-delete", resource: "doc", method: "DELETE", path: "/v0/bundles/{bundle}/docs/{id...}" },
       {
         id: "doc-versions",
         resource: "doc-versions",
         method: "GET",
-        path: "/v0/bundles/{bundle}/docs/{id...}/versions"
+        path: "/v0/bundles/{bundle}/docs/{id...}/versions",
+        accessClass: "read"
       },
       {
         id: "reserved-read",
         resource: "reserved",
         method: "GET",
-        path: "/v0/bundles/{bundle}/reserved/{name}"
+        path: "/v0/bundles/{bundle}/reserved/{name}",
+        accessClass: "read"
       },
       {
         id: "reserved-write",
         resource: "reserved",
         method: "PUT",
-        path: "/v0/bundles/{bundle}/reserved/{name}"
+        path: "/v0/bundles/{bundle}/reserved/{name}",
+        accessClass: "write"
+      },
+      {
+        id: "blobs-list",
+        resource: "blobs",
+        method: "GET",
+        path: "/v0/bundles/{bundle}/blobs",
+        accessClass: "read"
+      },
+      {
+        id: "blob-read",
+        resource: "blob",
+        method: "GET",
+        path: "/v0/bundles/{bundle}/blobs/{key...}",
+        accessClass: "read"
+      },
+      {
+        id: "blob-write",
+        resource: "blob",
+        method: "PUT",
+        path: "/v0/bundles/{bundle}/blobs/{key...}",
+        accessClass: "write"
+      },
+      {
+        id: "blob-head",
+        resource: "blob",
+        method: "HEAD",
+        path: "/v0/bundles/{bundle}/blobs/{key...}",
+        accessClass: "read"
       },
-      { id: "blobs-list", resource: "blobs", method: "GET", path: "/v0/bundles/{bundle}/blobs" },
-      { id: "blob-read", resource: "blob", method: "GET", path: "/v0/bundles/{bundle}/blobs/{key...}" },
-      { id: "blob-write", resource: "blob", method: "PUT", path: "/v0/bundles/{bundle}/blobs/{key...}" },
-      { id: "blob-head", resource: "blob", method: "HEAD", path: "/v0/bundles/{bundle}/blobs/{key...}" },
       {
         id: "blob-delete",
         resource: "blob",
         method: "DELETE",
-        path: "/v0/bundles/{bundle}/blobs/{key...}"
+        path: "/v0/bundles/{bundle}/blobs/{key...}",
+        accessClass: "write"
       }
     ];
+    WireRequestResolutionError = class extends Error {
+      status;
+      code;
+      constructor(status2, code3, message) {
+        super(message);
+        this.name = "WireRequestResolutionError";
+        this.status = status2;
+        this.code = code3;
+      }
+    };
+    BUNDLE_ID_RE = /^bnd_[0-9a-f]{32}$/;
+  }
+});
+
+// ../server/src/legacy-router.ts
+function capabilitiesForBackend(backend) {
+  return backend.capabilities?.() ?? {
+    enforced_cas: backend instanceof MemoryBackend,
+    blobs: true,
+    projections: true,
+    backlinks: false
+  };
+}
+function legacyAttribution(request) {
+  const actor = request.headers.get("X-Actor")?.trim();
+  const agent = request.headers.get("X-Agent")?.trim();
+  return {
+    actor: actor || "unknown",
+    ...agent ? { agent } : {}
+  };
+}
+function canonicalizeLegacyBundleRoute(request) {
+  const url2 = new URL(request.url);
+  const match = /^\/v0\/bundles\/([^/]+)\/(.*)$/.exec(url2.pathname);
+  if (!match) return request;
+  url2.pathname = `/v0/bundles/${LEGACY_INTERNAL_BUNDLE_ID}/${match[2]}`;
+  return new Request(url2, request);
+}
+function buildLegacyRouter(backend) {
+  const workerRouter = createRouter({
+    capabilities: capabilitiesForBackend(backend),
+    resolveContext: (request) => ({ backend, attribution: legacyAttribution(request) })
+  });
+  return (request) => workerRouter(canonicalizeLegacyBundleRoute(request));
+}
+function createRouter2(bundle) {
+  return buildLegacyRouter(bundle.backend ?? new FilesystemBackend(bundle.root));
+}
+var LEGACY_INTERNAL_BUNDLE_ID;
+var init_legacy_router = __esm({
+  "../server/src/legacy-router.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_src();
+    init_router();
+    LEGACY_INTERNAL_BUNDLE_ID = "bnd_00000000000000000000000000000000";
   }
 });
 
@@ -13454,7 +13954,7 @@ async function writeResponseToServerResponse(res, response) {
   res.end(bytes);
 }
 function serve(options2) {
-  const router = createRouter(options2.bundle);
+  const router = createRouter2(options2.bundle);
   const host = options2.host ?? "127.0.0.1";
   return new Promise((resolve2, reject) => {
     const server = createServer((req, res) => {
@@ -13487,7 +13987,7 @@ var init_serve = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
-    init_router();
+    init_legacy_router();
     RequestBodyTooLargeError = class extends Error {
       limitBytes;
       constructor(limitBytes) {
@@ -13505,7 +14005,7 @@ var init_src3 = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
-    init_router();
+    init_legacy_router();
     init_serve();
   }
 });
@@ -13536,7 +14036,7 @@ async function resolveConceptIdCliArgument(bundle, raw, options2 = {}) {
   if (isReservedFile(pathFromConceptId(alias))) return alias;
   if (!trimmed.endsWith(".md")) return alias;
   const literal2 = withPrefix(conceptIdFromPath(`${trimmed}.md`), options2.prefix);
-  return literal2 !== alias && await existsDoc(bundle, literal2) ? literal2 : alias;
+  return literal2 !== alias && await existsDoc2(bundle, literal2) ? literal2 : alias;
 }
 var init_concept_id = __esm({
   "src/concept-id.ts"() {
@@ -13906,7 +14406,7 @@ function sameEntry(existing, source) {
 }
 async function readRegistrationIfPresent(bundle, viewId) {
   try {
-    return await readDocVersioned(bundle, viewId);
+    return await readDocVersioned2(bundle, viewId);
   } catch (error51) {
     if (error51?.code === "ENOENT") return null;
     throw error51;
@@ -13937,7 +14437,7 @@ async function persistTransientView(bundle, source, input, revalidateSource, opt
     body: ""
   };
   const [existingEntry, existingRegistry] = await Promise.all([
-    readBlob(bundle, entry),
+    readBlob2(bundle, entry),
     readRegistrationIfPresent(bundle, viewId)
   ]);
   if (existingEntry !== null && !sameEntry(existingEntry, source)) {
@@ -13956,7 +14456,7 @@ async function persistTransientView(bundle, source, input, revalidateSource, opt
     entryVersion = existingEntry.version;
   } else {
     try {
-      entryVersion = await writeBlob(
+      entryVersion = await writeBlob2(
         bundle,
         entry,
         source.bytes,
@@ -13965,7 +14465,7 @@ async function persistTransientView(bundle, source, input, revalidateSource, opt
       );
       entryCreated = true;
     } catch (error51) {
-      const winner = await readBlob(bundle, entry);
+      const winner = await readBlob2(bundle, entry);
       if (!sameEntry(winner, source)) {
         if (!(error51 instanceof VersionConflict)) {
           throw new TransientViewSaveError(
@@ -14040,7 +14540,7 @@ async function persistTransientView(bundle, source, input, revalidateSource, opt
       }
     }
     const [finalEntry, finalRegistry, finalSourceIsCurrent] = await Promise.all([
-      readBlob(bundle, entry),
+      readBlob2(bundle, entry),
       readRegistrationIfPresent(bundle, viewId),
       revalidateSource().catch(() => false)
     ]);
@@ -14064,7 +14564,7 @@ async function persistTransientView(bundle, source, input, revalidateSource, opt
     };
   } catch (error51) {
     const [currentEntry, currentRegistry] = await Promise.all([
-      readBlob(bundle, entry).catch(() => null),
+      readBlob2(bundle, entry).catch(() => null),
       readRegistrationIfPresent(bundle, viewId).catch(() => null)
     ]);
     if (error51 instanceof TransientViewSaveError) {
@@ -14212,7 +14712,7 @@ function cachedAdmission(admitEntry) {
   };
 }
 async function admitBundleEntry(bundle, entry, expectedVersion) {
-  const blob = await readBlob(bundle, entry);
+  const blob = await readBlob2(bundle, entry);
   if (blob === null) return false;
   if (expectedVersion && expectedVersion !== blob.version) return false;
   admitActiveView(blob.bytes, blob.contentType);
@@ -14240,7 +14740,7 @@ async function projectViewCatalog(heads, options2) {
 }
 async function listViewCatalog(bundle) {
   const skipped = [];
-  const heads = await queryHeads(bundle, { type: "View" }, { onSkip: (row2) => skipped.push(row2) });
+  const heads = await queryHeads2(bundle, { type: "View" }, { onSkip: (row2) => skipped.push(row2) });
   return projectViewCatalog(heads, {
     skippedDocuments: skipped.length,
     admitEntry: (entry, expectedVersion) => admitBundleEntry(bundle, entry, expectedVersion)
@@ -14254,7 +14754,7 @@ async function listViewCatalogPage(bundle, options2) {
     throw new Error("View catalog scan limit must be a safe integer at least as large as the page limit");
   }
   const skipped = [];
-  const heads = await queryHeads(bundle, { type: "View" }, { onSkip: (row2) => skipped.push(row2) });
+  const heads = await queryHeads2(bundle, { type: "View" }, { onSkip: (row2) => skipped.push(row2) });
   const { candidates, invalidRegistrations } = projectCandidates(heads);
   const supported = new Set(options2.access);
   const compatible = candidates.filter((candidate) => supported.has(candidate.row.access));
@@ -14516,13 +15016,13 @@ var init_bridge = __esm({
         let outcome;
         try {
           outcome = await this.execute(before, request);
-        } catch (error51) {
+        } catch {
           outcome = {
             reply: fail(
               request.id,
               request.bridge,
               "RUNTIME",
-              error51 instanceof Error ? error51.message : String(error51)
+              "the View request failed"
             )
           };
         }
@@ -14566,11 +15066,8 @@ var init_bridge = __esm({
         let next;
         try {
           next = await this.subscriptionSnapshot();
-        } catch (error51) {
-          return this.reload(
-            launchId,
-            error51 instanceof Error ? error51.message : String(error51)
-          );
+        } catch {
+          return this.reload(launchId, "the View subscription could not be refreshed");
         }
         const after = await this.options.launches.resolve(launchId, true);
         if (!after) return this.reload(launchId, "the View changed while its subscription was polled");
@@ -14605,7 +15102,7 @@ var init_bridge = __esm({
         return { status: "reload-required", message };
       }
       async subscriptionSnapshot() {
-        const rows = await queryHeads(this.options.bundle, {});
+        const rows = await queryHeads2(this.options.bundle, {});
         if (rows.length > MAX_SUBSCRIPTION_HEADS) {
           throw new Error("the bundle is too large for the experimental View polling snapshot");
         }
@@ -14620,7 +15117,7 @@ var init_bridge = __esm({
             return { reply: null, openPageId: request.pageId };
           }
           try {
-            const target = await readDocVersioned(this.options.bundle, request.pageId);
+            const target = await readDocVersioned2(this.options.bundle, request.pageId);
             if (!isAnyRegistryId(target.doc.id) || !parseRegistration(target.doc.id, target.doc.frontmatter)) {
               throw new Error("invalid View target");
             }
@@ -14641,13 +15138,13 @@ var init_bridge = __esm({
           };
         }
         if (request.type === "query") {
-          const rows = await queryHeads(this.options.bundle, {
+          const rows = await queryHeads2(this.options.bundle, {
             ...request.params.type ? { type: request.params.type } : {},
             ...request.params.prefix ? { prefix: request.params.prefix } : {}
           });
           const [registry2, okfVersion] = await Promise.all([
             loadKinds(this.options.bundle),
-            readBundleOkfVersion(this.options.bundle)
+            readBundleOkfVersion2(this.options.bundle)
           ]);
           const result3 = boundedRows(
             rows,
@@ -14662,9 +15159,9 @@ var init_bridge = __esm({
         }
         if (request.type === "read" || request.type === "read-versioned") {
           const [result3, registry2, okfVersion] = await Promise.all([
-            readDocVersioned(this.options.bundle, request.docId),
+            readDocVersioned2(this.options.bundle, request.docId),
             loadKinds(this.options.bundle),
-            readBundleOkfVersion(this.options.bundle)
+            readBundleOkfVersion2(this.options.bundle)
           ]);
           if (Buffer.byteLength(result3.doc.body, "utf8") > MAX_DOCUMENT_BODY_BYTES) {
             return { reply: fail(request.id, request.bridge, "TOO_LARGE", "the document body exceeded the 1 MiB View limit") };
@@ -14683,7 +15180,7 @@ var init_bridge = __esm({
         if (request.type === "render-document") {
           let result3;
           try {
-            result3 = await readDocVersioned(this.options.bundle, request.docId);
+            result3 = await readDocVersioned2(this.options.bundle, request.docId);
           } catch (error51) {
             if (error51?.code === "ENOENT") {
               return {
@@ -14710,7 +15207,7 @@ var init_bridge = __esm({
           };
         }
         if (request.type === "edges") {
-          const edges = await queryEdges(this.options.bundle, request.params);
+          const edges = await queryEdges2(this.options.bundle, request.params);
           if (edges.length > MAX_EDGE_ROWS) {
             return { reply: fail(request.id, request.bridge, "TOO_LARGE", `the edge query exceeded ${MAX_EDGE_ROWS} rows`) };
           }
@@ -14776,13 +15273,13 @@ async function launchIsCurrent(bundle, launch) {
     return launch.bundleIdentity === bundle.root && blobVersion(launch.bytes) === launch.contentVersion;
   }
   try {
-    const registryRead = await readDocVersioned(bundle, launch.registryId);
+    const registryRead = await readDocVersioned2(bundle, launch.registryId);
     if (registryRead.version !== launch.registryVersion) return false;
     const registration = parseRegistration(registryRead.doc.id, registryRead.doc.frontmatter);
     if (!registration || registration.type !== launch.registryType || registration.entry !== launch.entryKey || resolveDeclaredAccess(registryRead.doc.frontmatter) !== launch.capability) {
       return false;
     }
-    const blob = await readBlob(bundle, launch.entryKey);
+    const blob = await readBlob2(bundle, launch.entryKey);
     if (blob === null) return false;
     if (registration.entryVersion && registration.entryVersion !== blob.version) return false;
     const admitted = admitActiveView(blob.bytes, blob.contentType);
@@ -14794,14 +15291,14 @@ async function launchIsCurrent(bundle, launch) {
 async function mintActiveViewLaunch(bundle, launches, registryId) {
   let registryRead;
   try {
-    registryRead = await readDocVersioned(bundle, registryId);
+    registryRead = await readDocVersioned2(bundle, registryId);
   } catch (error51) {
     if (error51?.code === "ENOENT") {
       throw new ViewNotFoundError(registryId, error51);
     }
     throw new RegisteredViewLaunchError(
       "VIEW_REGISTRY_READ_FAILED",
-      error51 instanceof Error ? error51.message : String(error51),
+      "the View registration could not be read",
       registryId,
       void 0,
       error51
@@ -14817,11 +15314,11 @@ async function mintActiveViewLaunch(bundle, launches, registryId) {
   }
   let blob;
   try {
-    blob = await readBlob(bundle, registration.entry);
+    blob = await readBlob2(bundle, registration.entry);
   } catch (error51) {
     throw new RegisteredViewLaunchError(
       "VIEW_ENTRY_READ_FAILED",
-      error51 instanceof Error ? error51.message : String(error51),
+      "the View entry could not be read",
       registryId,
       registration.entry,
       error51
@@ -14846,10 +15343,10 @@ async function mintActiveViewLaunch(bundle, launches, registryId) {
   let admitted;
   try {
     admitted = admitActiveView(blob.bytes, blob.contentType);
-  } catch (error51) {
+  } catch {
     throw new RegisteredViewLaunchError(
       "VIEW_ADMISSION_REJECTED",
-      error51 instanceof Error ? error51.message : String(error51),
+      "the View entry must be bounded UTF-8 text/html",
       registryId,
       registration.entry
     );
@@ -15139,8 +15636,8 @@ var init_src4 = __esm({
         let action;
         try {
           action = parseDocumentSetFieldAction(rawAction);
-        } catch (error51) {
-          return rejected(error51 instanceof Error ? error51.message : String(error51));
+        } catch {
+          return rejected("the action request is invalid");
         }
         if (["type", "timestamp", "actor"].includes(action.field)) return rejected(`field '${action.field}' is shell-managed and cannot be proposed`);
         if (launch.documentVersions && (!Object.hasOwn(launch.documentVersions, action.docId) || launch.documentVersions[action.docId] !== action.expectedVersion)) {
@@ -15148,10 +15645,10 @@ var init_src4 = __esm({
         }
         let target;
         try {
-          target = await readDocVersioned(this.bundle, action.docId);
+          target = await readDocVersioned2(this.bundle, action.docId);
         } catch (error51) {
           if (error51?.code === "ENOENT") return rejected(`document '${action.docId}' does not exist`);
-          return { status: "failed", action: "document.set-field", message: error51 instanceof Error ? error51.message : String(error51) };
+          return { status: "failed", action: "document.set-field", message: "the target document could not be read" };
         }
         if (target.version !== action.expectedVersion) {
           return {
@@ -15168,10 +15665,10 @@ var init_src4 = __esm({
         try {
           [registry2, okfVersion] = await Promise.all([
             loadKinds(this.bundle),
-            readBundleOkfVersion(this.bundle)
+            readBundleOkfVersion2(this.bundle)
           ]);
-        } catch (error51) {
-          return { status: "failed", action: "document.set-field", message: error51 instanceof Error ? error51.message : String(error51) };
+        } catch {
+          return { status: "failed", action: "document.set-field", message: "the governing Kind could not be read" };
         }
         const targetType = String(target.doc.frontmatter.type ?? "");
         const kind2 = registry2.kinds.get(targetType);
@@ -15220,9 +15717,9 @@ var init_src4 = __esm({
         if (violations.length > 0) return rejected(violations.map((warning) => warning.message).join("; "));
         let kindVersion;
         try {
-          kindVersion = (await readDocVersioned(this.bundle, kind2.id)).version;
-        } catch (error51) {
-          return { status: "failed", action: "document.set-field", message: error51 instanceof Error ? error51.message : String(error51) };
+          kindVersion = (await readDocVersioned2(this.bundle, kind2.id)).version;
+        } catch {
+          return { status: "failed", action: "document.set-field", message: "the governing Kind version could not be read" };
         }
         this.sweepExpired();
         if (this.pending.size >= this.maxApprovals) return rejected("the trusted shell has too many pending confirmations; cancel one and try again");
@@ -15278,7 +15775,7 @@ var init_src4 = __esm({
           return { status: "revoked", action: "document.set-field", docId: pending.action.docId, field: pending.action.field };
         }
         try {
-          const target = await readDocVersioned(this.bundle, pending.action.docId);
+          const target = await readDocVersioned2(this.bundle, pending.action.docId);
           if (target.version !== pending.action.expectedVersion) {
             return {
               status: "conflict",
@@ -15291,7 +15788,7 @@ var init_src4 = __esm({
           }
           const [registry2, okfVersion] = await Promise.all([
             loadKinds(this.bundle),
-            readBundleOkfVersion(this.bundle)
+            readBundleOkfVersion2(this.bundle)
           ]);
           if (okfVersion !== pending.okfVersion) {
             return { status: "revoked", action: "document.set-field", message: "the bundle OKF edition changed" };
@@ -15302,7 +15799,7 @@ var init_src4 = __esm({
           if (!fieldCoordinate || fieldCoordinate.storageField !== pending.storageField) {
             return { status: "revoked", action: "document.set-field", message: "the governing Kind field mapping changed" };
           }
-          const currentKindVersion = (await readDocVersioned(this.bundle, kind2.id)).version;
+          const currentKindVersion = (await readDocVersioned2(this.bundle, kind2.id)).version;
           if (currentKindVersion !== pending.kindVersion || kindDigest(kind2) !== pending.kindDigest) {
             return { status: "revoked", action: "document.set-field", message: "the governing Kind changed" };
           }
@@ -15365,12 +15862,12 @@ var init_src4 = __esm({
             return { status: "conflict", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, expectedVersion: pending.action.expectedVersion, actualVersion: null };
           }
           if (error51 instanceof KindConformanceError) {
-            return { status: "rejected", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: error51.message };
+            return { status: "rejected", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: "the document no longer conforms to its governing Kind" };
           }
           if (error51 instanceof ActionBundleEditionChanged) {
-            return { status: "revoked", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: error51.message };
+            return { status: "revoked", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: "the bundle OKF edition changed" };
           }
-          return { status: "failed", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: error51 instanceof Error ? error51.message : String(error51) };
+          return { status: "failed", action: "document.set-field", docId: pending.action.docId, field: pending.action.field, message: "the trusted action could not be committed" };
         }
       }
       size() {
@@ -15432,8 +15929,8 @@ async function proxyToRemote(request, remoteBase, apiKey, signal) {
   let upstream;
   try {
     upstream = await fetch(new Request(target, { method, headers, body: bodyBytes, signal }));
-  } catch (err) {
-    return freshErrorResponse(502, "RUNTIME", `could not reach remote ${remoteBase} (${err instanceof Error ? err.message : String(err)})`);
+  } catch {
+    return freshErrorResponse(502, "RUNTIME", "could not reach remote bundle server");
   }
   return new Response(upstream.body, {
     status: upstream.status,
@@ -15528,19 +16025,19 @@ function isEmptyChange(e) {
   return e.docs.changed.length === 0 && e.docs.removed.length === 0 && e.blobs.changed.length === 0 && e.blobs.removed.length === 0;
 }
 async function snapshotBundle(bundle) {
-  const heads = await queryHeads(bundle, {});
+  const heads = await queryHeads2(bundle, {});
   const docs = new Map(heads.map((h2) => [h2.id, h2.version]));
   const blobs2 = /* @__PURE__ */ new Map();
   const keys = [];
   for (const prefix of PAGE_BLOB_PREFIXES) {
     try {
-      keys.push(...await listBlobs(bundle, prefix));
+      keys.push(...await listBlobs2(bundle, prefix));
     } catch {
     }
   }
   for (const key of keys) {
     try {
-      const r2 = await readBlob(bundle, key);
+      const r2 = await readBlob2(bundle, key);
       if (r2) blobs2.set(key, r2.version);
     } catch {
     }
@@ -15796,8 +16293,7 @@ async function servePageBytes(options2, runtime, nonce) {
 }
 function mintFailureResponse(options2, registryId, error51) {
   if (error51 instanceof ViewNotFoundError) {
-    const detail = error51.storageCause instanceof Error ? error51.storageCause.message : error51.message;
-    return jsonError(404, "RUNTIME", detail);
+    return jsonError(404, "RUNTIME", error51.message);
   }
   if (error51 instanceof RegisteredViewLaunchError) {
     switch (error51.code) {
@@ -15821,7 +16317,7 @@ function mintFailureResponse(options2, registryId, error51) {
         return jsonError(403, "FORBIDDEN", error51.message);
     }
   }
-  return jsonError(500, "RUNTIME", error51 instanceof Error ? error51.message : String(error51));
+  return jsonError(500, "RUNTIME", "the View could not be launched");
 }
 async function handleMint(req, runtime, options2) {
   let payload;
@@ -15842,18 +16338,18 @@ async function handleMint(req, runtime, options2) {
   if (!registryId && legacyKey) {
     try {
       assertSafeBlobKey(legacyKey);
-    } catch (error51) {
-      return jsonError(400, "USAGE", error51 instanceof Error ? error51.message : String(error51));
+    } catch {
+      return jsonError(400, "USAGE", "the View entry key is invalid");
     }
     const matches = [];
     try {
-      const heads = await queryHeads(options2.bundle, { type: "View" });
+      const heads = await queryHeads2(options2.bundle, { type: "View" });
       for (const head of heads) {
         const registration = parseRegistration(head.id, head.frontmatter);
         if (registration?.entry === legacyKey) matches.push(registration.id);
       }
-    } catch (error51) {
-      return jsonError(502, "RUNTIME", `could not read the View registry (${error51 instanceof Error ? error51.message : String(error51)})`);
+    } catch {
+      return jsonError(502, "RUNTIME", "could not read the View registry");
     }
     registryId = matches.sort()[0] ?? "";
     if (!registryId) return jsonError(403, "FORBIDDEN", `'${legacyKey}' is not the entry of any valid registered View`);
@@ -15936,10 +16432,10 @@ async function sharingSummary(options2) {
   if (!options2.loadSharingSummary) return null;
   try {
     return await options2.loadSharingSummary();
-  } catch (err) {
+  } catch {
     return {
       kind: "unavailable",
-      reason: err instanceof Error ? err.message : String(err),
+      reason: "sharing status could not be loaded",
       as_of: (/* @__PURE__ */ new Date()).toISOString()
     };
   }
@@ -15958,7 +16454,7 @@ async function kindsResponse(options2) {
   try {
     const [registry2, version2] = await Promise.all([
       loadKinds(options2.bundle),
-      readBundleOkfVersion(options2.bundle)
+      readBundleOkfVersion2(options2.bundle)
     ]);
     kinds2 = Array.from(registry2.kinds.values());
     okfVersion = version2 ?? "0.1";
@@ -15983,11 +16479,11 @@ async function viewsResponse(options2) {
       status: 200,
       headers: { "content-type": "application/json; charset=utf-8" }
     });
-  } catch (error51) {
+  } catch {
     return jsonError(
       502,
       "RUNTIME",
-      `could not read the View catalog (${error51 instanceof Error ? error51.message : String(error51)})`
+      "could not read the View catalog"
     );
   }
 }
@@ -16001,9 +16497,9 @@ async function edgesResponse(options2, url2) {
   if (text4) filter.text = text4;
   let links;
   try {
-    links = await queryEdges(options2.bundle, filter);
-  } catch (err) {
-    return jsonError(502, "RUNTIME", `could not read the bundle's edges (${err instanceof Error ? err.message : String(err)})`);
+    links = await queryEdges2(options2.bundle, filter);
+  } catch {
+    return jsonError(502, "RUNTIME", "could not read the bundle's edges");
   }
   const edges = links.map((l) => ({ from: l.from, to: l.to, text: l.text }));
   return new Response(JSON.stringify({ edges, count: edges.length }), {
@@ -16304,10 +16800,10 @@ async function bootUiServer(options2) {
   return new Promise((resolve2, reject) => {
     const inFlight = /* @__PURE__ */ new Set();
     const server = createServer2((req, res) => {
-      const handled = handleRequest(req, res, options2, runtime, sessionSecret).catch((err) => {
+      const handled = handleRequest(req, res, options2, runtime, sessionSecret).catch(() => {
         try {
           res.writeHead(500, { "content-type": "application/json; charset=utf-8" });
-          res.end(JSON.stringify({ error: { code: "RUNTIME", message: err instanceof Error ? err.message : String(err) } }));
+          res.end(JSON.stringify({ error: { code: "RUNTIME", message: "internal server error" } }));
         } catch {
           res.destroy();
         }
@@ -54345,7 +54841,7 @@ function nonEmptyString2(value) {
 }
 async function deriveBundleDisplayName(bundle) {
   try {
-    const doc2 = await readDoc(bundle, BUNDLE_NAME_DOC_ID);
+    const doc2 = await readDoc2(bundle, BUNDLE_NAME_DOC_ID);
     if (nonEmptyString2(doc2.frontmatter.type) === BUNDLE_NAME_DOC_TYPE) {
       const explicit = nonEmptyString2(doc2.frontmatter.name) ?? nonEmptyString2(doc2.frontmatter.title);
       if (explicit) return { name: explicit, source: "explicit" };
@@ -54619,7 +55115,7 @@ async function mutateCatalog(decide, options2) {
         schema_version: CATALOG_SCHEMA_VERSION,
         entries: [...result3.next.entries].sort((a, b) => a.label.localeCompare(b.label))
       };
-      await writeUserStateFileAtomic0600(home2, catalogDir(home2), CATALOG_FILE_NAME, JSON.stringify(next, null, 2) + "\n");
+      await writeReadyUserStateFileAtomic0600(home2, CATALOG_FILE_NAME, JSON.stringify(next, null, 2) + "\n");
     }
     return { value: result3.value, changed: result3.changed };
   } finally {
@@ -56583,7 +57079,7 @@ async function runManagedDocumentUi({ values, positionals }, deps) {
   const bundle = route.bundle;
   const documentId = await resolveConceptIdCliArgument(bundle, rawDocumentId);
   try {
-    await readDocVersioned(bundle, documentId);
+    await readDocVersioned2(bundle, documentId);
   } catch (error51) {
     throw readErrorToCliError(error51, documentId, void 0);
   }
@@ -56711,7 +57207,7 @@ async function runUi({ values, positionals }, deps, entry) {
     rootLabel = base;
   } else {
     bundle = deps.localBundle ?? await openBundle(values.dir);
-    const router = createRouter(bundle);
+    const router = createRouter2(bundle);
     options2 = {
       mode: "dir",
       port,
@@ -56729,7 +57225,7 @@ async function runUi({ values, positionals }, deps, entry) {
     const resolvedDocumentId = await resolveConceptIdCliArgument(bundle, rawDocumentId);
     documentId = resolvedDocumentId;
     try {
-      await readDocVersioned(bundle, resolvedDocumentId);
+      await readDocVersioned2(bundle, resolvedDocumentId);
     } catch (error51) {
       throw readErrorToCliError(error51, resolvedDocumentId, values.remote);
     }
@@ -59117,21 +59613,21 @@ async function createRecipeDocument(bundle, doc2, okfVersion, now) {
   return result3.doc;
 }
 async function findLegacyViewConvention(bundle) {
-  const conventions = await query(bundle, { prefix: CONVENTIONS_PREFIX, type: "Convention" });
+  const conventions = await query2(bundle, { prefix: CONVENTIONS_PREFIX, type: "Convention" });
   for (const doc2 of conventions) {
     if (governsKind(doc2, LEGACY_VIEW_KIND_NAME)) return doc2.id;
   }
   return null;
 }
 async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).toISOString()) {
-  const okfVersion = await readBundleOkfVersion(bundle) ?? "0.1";
+  const okfVersion = await readBundleOkfVersion2(bundle) ?? "0.1";
   recipe2 = materializeRecipeForEdition(recipe2, okfVersion);
   await assertPortableTargetsCompatible(bundle, recipe2, now, okfVersion);
   const legacyConventionId = recipe2.docs.some((d2) => governsKind(d2, VIEW_KIND_NAME)) ? await findLegacyViewConvention(bundle) : null;
   let legacyRegistryDocs = null;
   const legacyRegistryDoc = async (id) => {
     legacyRegistryDocs ??= new Map(
-      (await query(bundle, { prefix: PAGE_REGISTRY_PREFIX })).map((doc2) => [doc2.id, doc2])
+      (await query2(bundle, { prefix: PAGE_REGISTRY_PREFIX })).map((doc2) => [doc2.id, doc2])
     );
     return legacyRegistryDocs.get(id);
   };
@@ -59155,7 +59651,7 @@ async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).t
       doc2 = await createRecipeDocument(bundle, doc2, okfVersion, now);
     } catch (err) {
       if (err instanceof VersionConflict) {
-        const existing = await readDoc(bundle, doc2.id);
+        const existing = await readDoc2(bundle, doc2.id);
         if (!sameInstalledDoc(existing, doc2, okfVersion)) {
           sourceDiffers2 = true;
           migrationWarnings.push({
@@ -59177,7 +59673,7 @@ async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).t
     const entryAlias = legacyEntryAlias(page.entry);
     const aliasDoc = registryAlias !== null && entryAlias !== null ? await legacyRegistryDoc(registryAlias) : void 0;
     if (registryAlias !== null && entryAlias !== null && aliasDoc !== void 0) {
-      const legacyBlob = await readBlob(bundle, entryAlias);
+      const legacyBlob = await readBlob2(bundle, entryAlias);
       if (legacyBlob !== null) {
         const registers = parseRegistration(aliasDoc.id, aliasDoc.frontmatter) !== null;
         if (registers) {
@@ -59210,10 +59706,10 @@ async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).t
     const desiredBytes = Buffer.from(page.html, "utf8");
     let entryChanged = true;
     try {
-      await writeBlob(bundle, page.entry, desiredBytes, void 0, { expectedVersion: null });
+      await writeBlob2(bundle, page.entry, desiredBytes, void 0, { expectedVersion: null });
     } catch (err) {
       if (!(err instanceof VersionConflict)) throw err;
-      const existing = await readBlob(bundle, page.entry);
+      const existing = await readBlob2(bundle, page.entry);
       const sameBytes = existing !== null && Buffer.from(existing.bytes).equals(desiredBytes);
       const sameContentType = existing?.contentType === resolveContentType(page.entry);
       if (!sameBytes || !sameContentType) throw recipeAssetConflict(recipe2.id, page.entry);
@@ -59225,7 +59721,7 @@ async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).t
       registry2 = await createRecipeDocument(bundle, registry2, okfVersion, now);
     } catch (err) {
       if (!(err instanceof VersionConflict)) throw err;
-      const existing = await readDoc(bundle, registry2.id);
+      const existing = await readDoc2(bundle, registry2.id);
       if (!sameInstalledDoc(existing, registry2, okfVersion)) throw recipeAssetConflict(recipe2.id, `${registry2.id}.md`);
       registryChanged = false;
     }
@@ -59245,7 +59741,7 @@ async function applyRecipe(bundle, recipe2, now = (/* @__PURE__ */ new Date()).t
       desired = await createRecipeDocument(bundle, desired, okfVersion, now);
     } catch (err) {
       if (!(err instanceof VersionConflict)) throw err;
-      const existing = await readDoc(bundle, desired.id);
+      const existing = await readDoc2(bundle, desired.id);
       if (!sameInstalledDoc(existing, desired, okfVersion)) throw recipeAssetConflict(recipe2.id, `${desired.id}.md`);
       changed = false;
     }
@@ -59282,12 +59778,12 @@ async function assertPortableTargetsCompatible(bundle, recipe2, now, okfVersion)
   const registries = /* @__PURE__ */ new Map();
   if (recipe2.pages.length > 0) {
     for (const prefix of [PAGE_REGISTRY_PREFIX, VIEW_REGISTRY_PREFIX]) {
-      const registryDocs = await query(bundle, { prefix });
+      const registryDocs = await query2(bundle, { prefix });
       for (const doc2 of registryDocs) registries.set(doc2.id, doc2);
     }
   }
   for (const page of recipe2.pages) {
-    const existingBlob = await readBlob(bundle, page.entry);
+    const existingBlob = await readBlob2(bundle, page.entry);
     if (existingBlob) {
       const desiredBytes = Buffer.from(page.html, "utf8");
       const sameBytes = Buffer.from(existingBlob.bytes).equals(desiredBytes);
@@ -59304,7 +59800,7 @@ async function assertPortableTargetsCompatible(bundle, recipe2, now, okfVersion)
   }
   const installedReferences = /* @__PURE__ */ new Map();
   if (recipe2.references.length > 0) {
-    const referenceDocs = await query(bundle, { prefix: "references/" });
+    const referenceDocs = await query2(bundle, { prefix: "references/" });
     for (const doc2 of referenceDocs) installedReferences.set(doc2.id, doc2);
   }
   for (const reference of recipe2.references) {
@@ -59337,7 +59833,7 @@ function recipeAssetConflict(recipeId, key) {
   );
 }
 async function appliedConventionDocs(bundle) {
-  const docs = await query(bundle, { prefix: CONVENTIONS_PREFIX });
+  const docs = await query2(bundle, { prefix: CONVENTIONS_PREFIX });
   return new Map(docs.map((d2) => [d2.id, d2]));
 }
 function recipeDrifts(recipe2, installed, okfVersion, now) {
@@ -60082,19 +60578,34 @@ var init_recipe_source_builtin = __esm({
 });
 
 // src/recipe-source-filesystem.ts
-import { promises as fs4 } from "node:fs";
+import { constants as constants4, promises as fs4 } from "node:fs";
 import path22 from "node:path";
+async function readContainedFile(real) {
+  const opened = await fs4.open(real, CONTAINED_FLAGS).then(
+    (handle2) => ({ handle: handle2 }),
+    (error51) => ({ code: error51.code })
+  );
+  if (!("handle" in opened)) return { refusal: opened.code === "ELOOP" ? "irregular" : "unreadable" };
+  const handle = opened.handle;
+  try {
+    if (!(await handle.stat()).isFile()) return { refusal: "irregular" };
+    return { text: await handle.readFile("utf8") };
+  } catch {
+    return { refusal: "unreadable" };
+  } finally {
+    await handle.close();
+  }
+}
 async function readRecipeDir(root) {
   const files = [];
   const rootReal = await fs4.realpath(root);
   const manifestPath = path22.join(root, "recipe.md");
   const manifestStat = await fs4.stat(manifestPath).catch(() => null);
   if (manifestStat?.isFile()) {
-    const manifestReal = await fs4.realpath(manifestPath).catch(() => null);
-    if (!manifestReal || manifestReal !== rootReal && !manifestReal.startsWith(rootReal + path22.sep)) {
-      throw new RecipeUnsafePathSignal("recipe.md");
-    }
-    const bytes = await fs4.readFile(manifestPath, "utf8");
+    const manifestReal = await containedRealpath(manifestPath, rootReal, "recipe.md");
+    const read = await readContainedFile(manifestReal);
+    if ("refusal" in read) throw new RecipeUnsafePathSignal("recipe.md", read.refusal);
+    const bytes = read.text;
     files.push({ path: "recipe.md", bytes });
     const { frontmatter } = parseMarkdown(bytes);
     if (frontmatter.content_policy === "definitions-only" || frontmatter.pages !== void 0) {
@@ -60123,13 +60634,10 @@ async function walkRecipeFiles(dir, relPrefix, rootReal, out, skip) {
       continue;
     }
     if (!entry.isFile() && !entry.isSymbolicLink()) continue;
-    const real = await fs4.realpath(abs).catch(() => null);
-    if (!real || real !== rootReal && !real.startsWith(rootReal + path22.sep)) {
-      throw new RecipeUnsafePathSignal(rel);
-    }
-    const stat6 = await fs4.stat(real).catch(() => null);
-    if (!stat6?.isFile()) throw new RecipeUnsafePathSignal(rel);
-    out.push({ path: rel, bytes: await fs4.readFile(abs, "utf8") });
+    const real = await containedRealpath(abs, rootReal, rel);
+    const read = await readContainedFile(real);
+    if ("refusal" in read) throw new RecipeUnsafePathSignal(rel, read.refusal);
+    out.push({ path: rel, bytes: read.text });
   }
 }
 async function walkConventions(dir, relPrefix, rootReal, out) {
@@ -60143,11 +60651,32 @@ async function walkConventions(dir, relPrefix, rootReal, out) {
     }
     if (!entry.isFile() && !entry.isSymbolicLink()) continue;
     if (!rel.endsWith(".md")) continue;
-    const real = await fs4.realpath(abs).catch(() => null);
-    if (!real || real !== rootReal && !real.startsWith(rootReal + path22.sep)) {
-      throw new RecipeUnsafePathSignal(rel);
-    }
-    out.push({ path: rel, bytes: await fs4.readFile(abs, "utf8") });
+    const real = await containedRealpath(abs, rootReal, rel);
+    const read = await readContainedFile(real);
+    if ("refusal" in read) throw new RecipeUnsafePathSignal(rel, read.refusal);
+    out.push({ path: rel, bytes: read.text });
+  }
+}
+async function containedRealpath(abs, rootReal, rel) {
+  const real = await fs4.realpath(abs).catch(() => null);
+  if (!real) throw new RecipeUnsafePathSignal(rel, "unresolvable");
+  if (real !== rootReal && !real.startsWith(rootReal + path22.sep)) {
+    throw new RecipeUnsafePathSignal(rel, "symlink-escape");
+  }
+  return real;
+}
+function refusalMessage(ref, err) {
+  switch (err.reason) {
+    case "dot-entry":
+      return `recipe folder '${ref}' contains a dot-prefixed path, which the recipe grammar can never accept: '${err.rel}'`;
+    case "irregular":
+      return `recipe folder '${ref}' contains a path that is not a regular file: '${err.rel}'`;
+    case "unreadable":
+      return `recipe folder '${ref}' contains a file that could not be opened for reading (check its permissions): '${err.rel}'`;
+    case "symlink-escape":
+      return `recipe folder '${ref}' contains a symlink escaping the recipe root: '${err.rel}'`;
+    case "unresolvable":
+      return `recipe folder '${ref}' contains a path that does not resolve, most often a symlink whose target is gone: '${err.rel}'`;
   }
 }
 function filesRecipeSource() {
@@ -60169,7 +60698,7 @@ function filesRecipeSource() {
         files = await readRecipeDir(real);
       } catch (err) {
         if (err instanceof RecipeUnsafePathSignal) {
-          const message = err.reason === "dot-entry" ? `recipe folder '${ref}' contains a dot-prefixed path, which the recipe grammar can never accept: '${err.rel}'` : `recipe folder '${ref}' contains a symlink escaping the recipe root: '${err.rel}'`;
+          const message = refusalMessage(ref, err);
           return { ok: false, error: { code: "RECIPE_UNSAFE_PATH", message } };
         }
         throw err;
@@ -60178,7 +60707,7 @@ function filesRecipeSource() {
     }
   };
 }
-var RecipeUnsafePathSignal;
+var CONTAINED_FLAGS, RecipeUnsafePathSignal;
 var init_recipe_source_filesystem = __esm({
   "src/recipe-source-filesystem.ts"() {
     "use strict";
@@ -60187,6 +60716,7 @@ var init_recipe_source_filesystem = __esm({
     init_src();
     init_recipe_parser();
     init_recipe_ref();
+    CONTAINED_FLAGS = constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0) | (constants4.O_NONBLOCK ?? 0);
     RecipeUnsafePathSignal = class extends Error {
       rel;
       reason;
@@ -60537,9 +61067,9 @@ function computeDroppedLinks(existingLinks, nextLinks) {
   return dropped;
 }
 function droppedLinks(bundle, existing, nextBody) {
-  const existingLinks = parseLinks(bundle, existing);
+  const existingLinks = parseLinks2(bundle, existing);
   if (existingLinks.length === 0) return [];
-  return computeDroppedLinks(existingLinks, parseLinks(bundle, { ...existing, body: nextBody }));
+  return computeDroppedLinks(existingLinks, parseLinks2(bundle, { ...existing, body: nextBody }));
 }
 function guardDroppedLinks(bundle, existing, nextBody, replaceLinks) {
   if (replaceLinks) return;
@@ -60596,7 +61126,7 @@ async function docExistsForMode(bundle, id, mode) {
   if (mode === "patch") return true;
   if (mode === "create-only") return false;
   try {
-    await readDoc(bundle, id);
+    await readDoc2(bundle, id);
     return true;
   } catch {
     return false;
@@ -61441,7 +61971,7 @@ async function docReadInner(argv2, deps) {
       let parsed;
       let version2;
       try {
-        ({ doc: parsed, version: version2 } = await readDocVersioned(bundle, id));
+        ({ doc: parsed, version: version2 } = await readDocVersioned2(bundle, id));
       } catch (err) {
         throw readErrorToCliError(err, id, values.remote);
       }
@@ -61481,7 +62011,7 @@ async function docReadInner(argv2, deps) {
     let parsed;
     let version2;
     try {
-      ({ doc: parsed, version: version2 } = await readDocVersioned(bundle, id));
+      ({ doc: parsed, version: version2 } = await readDocVersioned2(bundle, id));
     } catch (err) {
       throw readErrorToCliError(err, id, values.remote);
     }
@@ -61514,7 +62044,7 @@ async function docReadInner(argv2, deps) {
       let parsed;
       let version2;
       try {
-        ({ doc: parsed, version: version2 } = await readDocVersioned(bundle, id));
+        ({ doc: parsed, version: version2 } = await readDocVersioned2(bundle, id));
       } catch (err) {
         throw readErrorToCliError(err, id, values.remote);
       }
@@ -61531,7 +62061,7 @@ async function docReadInner(argv2, deps) {
     let parsed;
     let version2;
     try {
-      ({ doc: parsed, version: version2 } = await readDocVersioned(bundle, id));
+      ({ doc: parsed, version: version2 } = await readDocVersioned2(bundle, id));
     } catch (err) {
       throw readErrorToCliError(err, id, values.remote);
     }
@@ -61563,7 +62093,7 @@ async function docReadInner(argv2, deps) {
     if (bundle.backend) {
       let parsed;
       try {
-        parsed = await readDoc(bundle, id);
+        parsed = await readDoc2(bundle, id);
       } catch (err) {
         throw readErrorToCliError(err, id, values.remote);
       }
@@ -61696,7 +62226,7 @@ async function docHistory(argv2, deps) {
   id = await resolveConceptIdCliArgument(bundle, rawId);
   let versions;
   try {
-    versions = await docVersions(bundle, id);
+    versions = await docVersions2(bundle, id);
   } catch (err) {
     throw readErrorToCliError(err, id, values.remote);
   }
@@ -61812,7 +62342,7 @@ async function docDelete(argv2, deps) {
   const expectedVersion = rawExpected?.trim();
   let deleted;
   try {
-    deleted = await deleteDoc(bundle, id, expectedVersion ? { expectedVersion } : void 0);
+    deleted = await deleteDoc2(bundle, id, expectedVersion ? { expectedVersion } : void 0);
   } catch (err) {
     if (err instanceof VersionConflict) {
       throw new CliError(
@@ -62055,7 +62585,7 @@ async function promoteBlob(file2, key, bundle, opts, stdout, mode, remoteUrl) {
   }
   let version2;
   try {
-    version2 = await writeBlob(bundle, key, bytes, opts.contentType, { expectedVersion: opts.expectedVersion });
+    version2 = await writeBlob2(bundle, key, bytes, opts.contentType, { expectedVersion: opts.expectedVersion });
   } catch (err) {
     throw promoteWriteErrorToCliError(err, key, file2, remoteUrl);
   }
@@ -62195,7 +62725,7 @@ async function pullDoc(bundle, key, remoteUrl) {
   const id = conceptIdFromPath(canonicalPath);
   let result3;
   try {
-    result3 = await readDocVersioned(bundle, id);
+    result3 = await readDocVersioned2(bundle, id);
   } catch (err) {
     throw readErrorToCliError(err, id, remoteUrl);
   }
@@ -62215,7 +62745,7 @@ async function pullDoc(bundle, key, remoteUrl) {
 async function pullBlob(bundle, key, remoteUrl) {
   let result3;
   try {
-    result3 = await readBlob(bundle, key);
+    result3 = await readBlob2(bundle, key);
   } catch (err) {
     throw classifyBundleError(err, remoteUrl);
   }
@@ -62398,7 +62928,7 @@ async function blobs(argv2, deps = {}) {
     limit = Number(raw);
   }
   const bundle = await openBundle(values.dir, await resolveRemoteFlag(values.remote, values.dir));
-  const keys = (await listBlobs(bundle, values.prefix?.trim() || void 0)).slice().sort();
+  const keys = (await listBlobs2(bundle, values.prefix?.trim() || void 0)).slice().sort();
   const total = keys.length;
   const shownKeys = limit > 0 ? keys.slice(0, limit) : keys;
   const truncated = shownKeys.length < total;
@@ -62500,9 +63030,9 @@ async function deleteCommand(argv2, deps = {}) {
     if (docRoute) {
       const canonicalPath = key.slice(0, -3) + ".md";
       const id = conceptIdFromPath(canonicalPath);
-      deleted = await deleteDoc(bundle, id, expectedVersion ? { expectedVersion } : void 0);
+      deleted = await deleteDoc2(bundle, id, expectedVersion ? { expectedVersion } : void 0);
     } else {
-      deleted = await deleteBlob(bundle, key, expectedVersion ? { expectedVersion } : void 0);
+      deleted = await deleteBlob2(bundle, key, expectedVersion ? { expectedVersion } : void 0);
     }
   } catch (err) {
     throw deleteErrorToCliError(err, key, values.remote);
@@ -62609,7 +63139,7 @@ async function lintLinkType(bundle, args, registry2) {
     let targetType;
     let targetResolved = true;
     try {
-      targetType = docType(await readDoc(bundle, args.to));
+      targetType = docType(await readDoc2(bundle, args.to));
     } catch (err) {
       if (err?.code === "ENOENT") {
         targetResolved = false;
@@ -62649,7 +63179,7 @@ async function lintLinkType(bundle, args, registry2) {
 async function assertTargetNotAlias(bundle, to, remoteUrl) {
   if (remoteUrl !== void 0) return;
   try {
-    await readDoc(bundle, to);
+    await readDoc2(bundle, to);
   } catch (err) {
     if (err instanceof FilesystemIdentityAliasError) throw err;
   }
@@ -62657,7 +63187,7 @@ async function assertTargetNotAlias(bundle, to, remoteUrl) {
 async function targetAbsentWarning(bundle, to, remoteUrl) {
   if (remoteUrl !== void 0) return void 0;
   try {
-    await readDoc(bundle, to);
+    await readDoc2(bundle, to);
     return void 0;
   } catch (err) {
     if (err?.code !== "ENOENT") throw err;
@@ -62725,7 +63255,7 @@ async function addLink(bundle, from, to, opts = {}) {
     buildCandidate: (source, context) => {
       const existing = source;
       sourceTypeAtWrite = docType(existing);
-      const already = parseLinks(bundle, existing).some((l) => l.to === normalizedTo && l.text === text4);
+      const already = parseLinks2(bundle, existing).some((l) => l.to === normalizedTo && l.text === text4);
       if (already) return { frontmatter: { ...existing.frontmatter }, body: existing.body };
       const trimmed = existing.body.replace(/\s*$/, "");
       const nextBody = `${trimmed}${trimmed ? "\n\n" : ""}[${text4}](${href})
@@ -62899,8 +63429,8 @@ async function linkShow(argv2, stdout, autoPull) {
   let exists2 = !impossibleExactId;
   if (!impossibleExactId) {
     try {
-      const source = await readDoc(bundle, id);
-      outbound = parseLinks(bundle, source).map((l) => ({ to: l.to, text: l.text, href: l.href }));
+      const source = await readDoc2(bundle, id);
+      outbound = parseLinks2(bundle, source).map((l) => ({ to: l.to, text: l.text, href: l.href }));
     } catch (err) {
       if (err?.code !== "ENOENT") {
         throw classifyBundleError(err, values.remote);
@@ -62908,7 +63438,7 @@ async function linkShow(argv2, stdout, autoPull) {
       exists2 = false;
     }
   }
-  const inbound = await backlinks(bundle, id);
+  const inbound = await backlinks2(bundle, id);
   const textsPresent = textFilter === void 0 ? [] : [...new Set([...outbound, ...inbound].map((l) => l.text))].sort((a, b) => a.localeCompare(b));
   if (textFilter !== void 0) {
     outbound = outbound.filter((l) => l.text === textFilter);
@@ -63012,7 +63542,7 @@ async function linkList(argv2, stdout) {
   if (toSelectors.length > 0) scopeFilter.to = toSelectors;
   let scopedEdges;
   try {
-    scopedEdges = await queryEdges(bundle, scopeFilter);
+    scopedEdges = await queryEdges2(bundle, scopeFilter);
   } catch (err) {
     throw classifyBundleError(err, values.remote);
   }
@@ -63271,7 +63801,7 @@ async function list2(argv2, deps = {}) {
   if (!remote) await (deps.autoPull ?? maybeAutoPull2)(values.dir);
   const bundle = await openBundle(values.dir, remote);
   const skipped = [];
-  let docs = await queryHeads(bundle, filter, { onSkip: (s) => skipped.push(s) });
+  let docs = await queryHeads2(bundle, filter, { onSkip: (s) => skipped.push(s) });
   let registryCache;
   const getRegistry = async () => {
     registryCache ??= await loadKinds(bundle);
@@ -63281,7 +63811,7 @@ async function list2(argv2, deps = {}) {
   let okfVersionCache;
   const getOkfVersion = async () => {
     if (!okfVersionLoaded) {
-      okfVersionCache = await readBundleOkfVersion(bundle);
+      okfVersionCache = await readBundleOkfVersion2(bundle);
       okfVersionLoaded = true;
     }
     return okfVersionCache;
@@ -63814,7 +64344,7 @@ async function newCommand(argv2, deps = {}) {
   if (route) await assertResolvedLocalRouteIdentity(route);
   const [registry2, okfVersion] = await Promise.all([
     loadKinds(bundle),
-    readBundleOkfVersion(bundle)
+    readBundleOkfVersion2(bundle)
   ]);
   const resolvedKind = registry2.kinds.get(kindName);
   const kind2 = resolvedKind && (pre.values.help || kindDeclaresAnything(resolvedKind)) ? resolvedKind : void 0;
@@ -64199,7 +64729,7 @@ async function kinds(argv2, deps = {}) {
   const bundle = await openBundle(values.dir, await resolveRemoteFlag(values.remote, values.dir));
   const [registry2, okfVersion] = await Promise.all([
     loadKinds(bundle),
-    readBundleOkfVersion(bundle)
+    readBundleOkfVersion2(bundle)
   ]);
   const rows = [...registry2.kinds.values()].sort((a, b) => a.governs.localeCompare(b.governs)).map((kind2) => toRow(kind2, okfVersion));
   const out = { count: rows.length, kinds: rows };
@@ -64338,7 +64868,7 @@ function inferredBody(type, count) {
 }
 async function prepareDraftPlan(bundle, type) {
   const inv = cliInvocation();
-  const [registry2, okfVersionRead] = await Promise.all([loadKinds(bundle), readBundleOkfVersion(bundle)]);
+  const [registry2, okfVersionRead] = await Promise.all([loadKinds(bundle), readBundleOkfVersion2(bundle)]);
   const okfVersion = okfVersionRead ?? "0.1";
   const existing = registry2.kinds.get(type);
   if (existing && kindDeclaresAnything(existing)) {
@@ -64348,7 +64878,7 @@ async function prepareDraftPlan(bundle, type) {
       { help: `${inv} kind field ${commandQuoted(type)} add <name>` }
     );
   }
-  const instances = (await query(bundle, { type })).sort((a, b) => a.id.localeCompare(b.id));
+  const instances = (await query2(bundle, { type })).sort((a, b) => a.id.localeCompare(b.id));
   if (instances.length === 0) {
     throw new CliError(
       "USAGE",
@@ -64513,7 +65043,7 @@ async function kindDismissCommand(type, values, stdout) {
   const inv = cliInvocation();
   const suffix = targetSuffix(values);
   const bundle = await openBundle(values.dir, await resolveRemoteFlag(values.remote, values.dir));
-  const [registry2, okfVersionRead] = await Promise.all([loadKinds(bundle), readBundleOkfVersion(bundle)]);
+  const [registry2, okfVersionRead] = await Promise.all([loadKinds(bundle), readBundleOkfVersion2(bundle)]);
   const okfVersion = okfVersionRead ?? "0.1";
   const existing = registry2.kinds.get(type);
   if (existing && kindDeclaresAnything(existing)) {
@@ -64776,7 +65306,7 @@ async function kind(argv2, deps = {}) {
     }
   }
   const bundle = await openBundle(values.dir, await resolveRemoteFlag(values.remote, values.dir));
-  const [registry2, okfVersion] = await Promise.all([loadKinds(bundle), readBundleOkfVersion(bundle)]);
+  const [registry2, okfVersion] = await Promise.all([loadKinds(bundle), readBundleOkfVersion2(bundle)]);
   const target = registry2.kinds.get(kindName);
   if (!target) {
     const known = [...registry2.kinds.keys()].sort();
@@ -65051,7 +65581,7 @@ async function recipes(argv2, deps = {}) {
   const bundle = await optionalBundle(values, resolvedDeps);
   const installed = bundle ? await appliedConventionDocs(bundle) : void 0;
   const appliedIds = installed === void 0 ? void 0 : new Set(installed.keys());
-  const okfVersion = bundle ? await readBundleOkfVersion(bundle) ?? "0.1" : void 0;
+  const okfVersion = bundle ? await readBundleOkfVersion2(bundle) ?? "0.1" : void 0;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const inv = cliInvocation();
   const rows = [];
@@ -65254,7 +65784,7 @@ function additiveConventionCandidate(existing, desired, blockers) {
 }
 async function readRecipeDocIfPresent(bundle, id) {
   try {
-    return await readDocVersioned(bundle, id);
+    return await readDocVersioned2(bundle, id);
   } catch (error51) {
     if (error51 instanceof DocumentNotFoundError || error51?.code === "ENOENT") return null;
     throw error51;
@@ -65344,7 +65874,7 @@ function evolutionPlanToken(input) {
   return `sha256:${createHash9("sha256").update(JSON.stringify(input), "utf8").digest("hex")}`;
 }
 async function prepareRecipeEvolution(bundle, sourceRecipe) {
-  const okfVersion = await readBundleOkfVersion(bundle) ?? "0.1";
+  const okfVersion = await readBundleOkfVersion2(bundle) ?? "0.1";
   const recipe2 = materializeRecipeForEdition(sourceRecipe, okfVersion);
   const blockers = recipe2.warnings.map((warning) => ({
     code: warning.code,
@@ -65357,7 +65887,7 @@ async function prepareRecipeEvolution(bundle, sourceRecipe) {
   const proofs = [];
   const desiredKinds = /* @__PURE__ */ new Map();
   const skippedConventions = [];
-  const installedConventions = await query(bundle, { prefix: CONVENTIONS_PREFIX, type: "Convention" }, {
+  const installedConventions = await query2(bundle, { prefix: CONVENTIONS_PREFIX, type: "Convention" }, {
     onSkip: (skipped) => skippedConventions.push(skipped)
   });
   for (const skipped of skippedConventions) {
@@ -65541,7 +66071,7 @@ async function prepareRecipeEvolution(bundle, sourceRecipe) {
   for (const reference of recipe2.references) await assetDocProof("reference", reference.doc);
   for (const page of recipe2.pages) {
     await assetDocProof("view-registry", page.registry);
-    const existing = await readBlob(bundle, page.entry);
+    const existing = await readBlob2(bundle, page.entry);
     const wantedBytes = Buffer.from(page.html, "utf8");
     const wanted = blobVersion(wantedBytes);
     proofs.push({ kind: "view-entry", id: page.entry, current_version: existing?.version ?? null, desired_version: wanted });
@@ -65566,7 +66096,7 @@ async function prepareRecipeEvolution(bundle, sourceRecipe) {
   const instanceProofs = [];
   if (changingKinds.length > 0) {
     const skippedInstances = [];
-    const docs = await query(bundle, {}, { onSkip: (skipped) => skippedInstances.push(skipped) });
+    const docs = await query2(bundle, {}, { onSkip: (skipped) => skippedInstances.push(skipped) });
     for (const skipped of skippedInstances) {
       evolutionBlocker(
         blockers,
@@ -66034,14 +66564,14 @@ async function status(argv2, deps = {}) {
   const malformedRows = [];
   const [registry2, docs, legacyBlobKeys, viewBlobKeys, okfVersionRead] = await Promise.all([
     loadKinds(bundle),
-    query(bundle, {}, { onSkip: (s) => malformedRows.push({ id: s.id, reason: s.reason }) }),
+    query2(bundle, {}, { onSkip: (s) => malformedRows.push({ id: s.id, reason: s.reason }) }),
     // legacy_naming audit (below): blob keys still under the legacy pages/ prefix — one extra
     // prefix-scoped listing on a command that is already an explicit whole-bundle read.
-    listBlobs(bundle, LEGACY_PAGE_BLOB_PREFIX),
+    listBlobs2(bundle, LEGACY_PAGE_BLOB_PREFIX),
     // dangling_view_entries (below): the views/ half of the entry-key existence set (the pages/
     // half is the legacy listing above — the only two prefixes a valid entry key can name).
-    listBlobs(bundle, VIEW_ENTRY_PREFIX),
-    readBundleOkfVersion(bundle).then((version2) => ({ version: version2 })).catch((error51) => {
+    listBlobs2(bundle, VIEW_ENTRY_PREFIX),
+    readBundleOkfVersion2(bundle).then((version2) => ({ version: version2 })).catch((error51) => {
       if (!(error51 instanceof MalformedDocumentError)) throw error51;
       return { version: void 0, malformed: { id: "index.md", reason: error51.message } };
     })
@@ -90938,11 +91468,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants6) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants4);
+          this.rhs = optimizeExpr(this.rhs, names, constants6);
         return this;
       }
       get names() {
@@ -90959,10 +91489,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants6) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants4);
+        this.rhs = optimizeExpr(this.rhs, names, constants6);
         return this;
       }
       get names() {
@@ -91023,8 +91553,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants4) {
-        this.code = optimizeExpr(this.code, names, constants4);
+      optimizeNames(names, constants6) {
+        this.code = optimizeExpr(this.code, names, constants6);
         return this;
       }
       get names() {
@@ -91053,12 +91583,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants6) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants4))
+          if (n.optimizeNames(names, constants6))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -91111,12 +91641,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants6) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
-        if (!(super.optimizeNames(names, constants4) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants6);
+        if (!(super.optimizeNames(names, constants6) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants4);
+        this.condition = optimizeExpr(this.condition, names, constants6);
         return this;
       }
       get names() {
@@ -91139,10 +91669,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants4) {
-        if (!super.optimizeNames(names, constants4))
+      optimizeNames(names, constants6) {
+        if (!super.optimizeNames(names, constants6))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants4);
+        this.iteration = optimizeExpr(this.iteration, names, constants6);
         return this;
       }
       get names() {
@@ -91178,10 +91708,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants4) {
-        if (!super.optimizeNames(names, constants4))
+      optimizeNames(names, constants6) {
+        if (!super.optimizeNames(names, constants6))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants4);
+        this.iterable = optimizeExpr(this.iterable, names, constants6);
         return this;
       }
       get names() {
@@ -91223,11 +91753,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants6) {
         var _a3, _b;
-        super.optimizeNames(names, constants4);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants4);
+        super.optimizeNames(names, constants6);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants6);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants6);
         return this;
       }
       get names() {
@@ -91528,7 +92058,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants4) {
+    function optimizeExpr(expr, names, constants6) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -91543,14 +92073,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants4[n.str];
+        const c = constants6[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants4[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants6[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -94050,9 +94580,9 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path41, query2] = wsComponent.resourceName.split("?");
+        const [path41, query3] = wsComponent.resourceName.split("?");
         wsComponent.path = path41 && path41 !== "/" ? path41 : void 0;
-        wsComponent.query = query2;
+        wsComponent.query = query3;
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -99488,7 +100018,7 @@ function createMcpBundleRuntime(context, options2 = {}) {
 }
 async function presentDocument(bundle, docId, pendingDocuments) {
   try {
-    const result3 = await readDocVersioned(bundle, docId);
+    const result3 = await readDocVersioned2(bundle, docId);
     const rendered = renderDocumentToStaticHtml({
       id: result3.doc.id,
       body: result3.doc.body
@@ -104053,6 +104583,61 @@ var init_install_scope = __esm({
   }
 });
 
+// src/nofollow-read.ts
+import { closeSync as closeSync3, constants as constants5, fstatSync as fstatSync4, lstatSync as lstatSync6, openSync as openSync3, readFileSync as readFileSync11 } from "node:fs";
+function leafIdentity(filePath) {
+  try {
+    const leaf = lstatSync6(filePath);
+    if (!leaf.isFile()) return null;
+    return { dev: leaf.dev, ino: leaf.ino };
+  } catch (error51) {
+    return error51.code === "ENOENT" ? "missing" : null;
+  }
+}
+function readRegularFileNoFollowSync(filePath) {
+  return readLeafSync(filePath, READ_FLAGS, HAS_NOFOLLOW);
+}
+function readLeafSync(filePath, flags, hasNoFollow) {
+  let expected = null;
+  if (!hasNoFollow) {
+    const identity = leafIdentity(filePath);
+    if (identity === null) return { state: "unsafe" };
+    if (identity === "missing") return { state: "missing" };
+    expected = identity;
+  }
+  let descriptor;
+  try {
+    descriptor = openSync3(filePath, flags);
+  } catch (error51) {
+    return error51.code === "ENOENT" ? { state: "missing" } : { state: "unsafe" };
+  }
+  try {
+    const opened = fstatSync4(descriptor);
+    if (!opened.isFile()) return { state: "unsafe" };
+    if (expected && (opened.dev !== expected.dev || opened.ino !== expected.ino)) return { state: "unsafe" };
+    return { state: "present", bytes: readFileSync11(descriptor) };
+  } catch {
+    return { state: "unsafe" };
+  } finally {
+    closeSync3(descriptor);
+  }
+}
+function readRegularFileTextNoFollowSync(filePath) {
+  const read = readRegularFileNoFollowSync(filePath);
+  if (read.state !== "present") return read;
+  return { state: "present", text: read.bytes.toString("utf8") };
+}
+var READ_FLAGS, HAS_NOFOLLOW;
+var init_nofollow_read = __esm({
+  "src/nofollow-read.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    READ_FLAGS = constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | (constants5.O_NONBLOCK ?? 0);
+    HAS_NOFOLLOW = (constants5.O_NOFOLLOW ?? 0) !== 0;
+  }
+});
+
 // src/integration-receipt.ts
 function integrationChangeReceipt(changedByHost) {
   const affected_hosts = HOST_ORDER.filter((host) => changedByHost[host] === true);
@@ -104073,9 +104658,9 @@ var init_integration_receipt = __esm({
 import {
   existsSync as existsSync6,
   linkSync as linkSync3,
-  lstatSync as lstatSync6,
+  lstatSync as lstatSync7,
   readlinkSync as readlinkSync3,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   renameSync as renameSync5,
   rmSync as rmSync3,
   symlinkSync
@@ -104305,7 +104890,7 @@ function targetSets(bases, deps) {
 function readSettings(path41) {
   if (!existsSync6(path41)) return {};
   try {
-    return JSON.parse(readFileSync11(path41, "utf8"));
+    return JSON.parse(readFileSync12(path41, "utf8"));
   } catch {
     return {};
   }
@@ -104317,7 +104902,7 @@ function readSettingsForInstall(path41) {
   if (!existsSync6(path41)) return { ok: true, settings: {} };
   let raw;
   try {
-    raw = readFileSync11(path41, "utf8");
+    raw = readFileSync12(path41, "utf8");
   } catch (err) {
     return { ok: false, reason: `unreadable (${err instanceof Error ? err.message : String(err)})` };
   }
@@ -104526,7 +105111,7 @@ function normalizedGeneratedSource(source) {
 function readOpenCodeHookStatus(path41, expectedSource) {
   let entry;
   try {
-    entry = lstatSync6(path41);
+    entry = lstatSync7(path41);
   } catch {
     return { installed: false, compatibility: { state: "absent", reason: "plugin file is absent" } };
   }
@@ -104542,12 +105127,14 @@ function readOpenCodeHookStatus(path41, expectedSource) {
   if (!entry.isFile()) {
     return { installed: false, compatibility: { state: "unmanaged", reason: "plugin path is not a regular file" } };
   }
-  let source;
-  try {
-    source = readFileSync11(path41, "utf8");
-  } catch {
+  const read = readRegularFileTextNoFollowSync(path41);
+  if (read.state === "missing") {
+    return { installed: false, compatibility: { state: "absent", reason: "plugin file is absent" } };
+  }
+  if (read.state === "unsafe") {
     return { installed: false, compatibility: { state: "unmanaged", reason: "plugin file is unreadable" } };
   }
+  const source = read.text;
   const comparableSource = normalizedGeneratedSource(source);
   if (expectedSource !== void 0 && comparableSource === normalizedGeneratedSource(expectedSource)) {
     return {
@@ -104638,7 +105225,7 @@ function openCodeClaimPath(path41) {
 }
 function restoreOpenCodeClaim(claim, path41) {
   try {
-    const entry = lstatSync6(claim);
+    const entry = lstatSync7(claim);
     if (entry.isSymbolicLink()) symlinkSync(readlinkSync3(claim), path41);
     else if (entry.isFile()) linkSync3(claim, path41);
     else throw new Error("claimed entry is not a regular file or symlink");
@@ -104898,7 +105485,7 @@ async function hook(argv2, deps = {}) {
     }
     const codexConfigPath = targets.codexConfig;
     try {
-      const current = existsSync6(codexConfigPath) ? readFileSync11(codexConfigPath, "utf8") : "";
+      const current = existsSync6(codexConfigPath) ? readFileSync12(codexConfigPath, "utf8") : "";
       const [updated, changed2] = computeCodexConfigUpdate(current);
       if (changed2) atomicWriteFileSync(codexConfigPath, updated);
       changedByHost.codex = changedByHost.codex === true || changed2;
@@ -104998,6 +105585,7 @@ var init_hook = __esm({
     init_hook_compatibility();
     init_install_authority();
     init_install_scope();
+    init_nofollow_read();
     init_integration_receipt();
     HOOK_USAGE = `superbee hook \u2014 manage the SessionStart board-aware hook
 
@@ -105695,7 +106283,7 @@ var init_establish_committed = __esm({
 });
 
 // src/commands/sync/establish.ts
-import { existsSync as existsSync7, lstatSync as lstatSync7, readdirSync as readdirSync2, renameSync as renameSync6, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync8, readdirSync as readdirSync2, renameSync as renameSync6, rmSync as rmSync4 } from "node:fs";
 import path35 from "node:path";
 function establishNextSteps(inv) {
   return [
@@ -105713,7 +106301,7 @@ function assertPlainBundleShape(bundlePath, inv) {
       { help: runInitHelp }
     );
   }
-  const root = lstatSync7(bundlePath);
+  const root = lstatSync8(bundlePath);
   if (root.isSymbolicLink() || !root.isDirectory()) {
     throw new CliError(
       "RUNTIME",
@@ -105739,7 +106327,7 @@ function assertPlainBundleShape(bundlePath, inv) {
       { help: runInitHelp }
     );
   }
-  const index2 = lstatSync7(indexPath);
+  const index2 = lstatSync8(indexPath);
   if (index2.isSymbolicLink() || !index2.isFile()) {
     throw new CliError("RUNTIME", `'${indexPath}' must be a real file \u2014 establish never follows it through a symlink`);
   }
@@ -105917,7 +106505,7 @@ async function publishLocalBoardBranch(top, boardPath, inv, mode, stdout, deps)
     }
   }
   const indexPath = path35.join(boardPath, "index.md");
-  if (!existsSync7(indexPath) || lstatSync7(indexPath).isSymbolicLink() || !lstatSync7(indexPath).isFile()) {
+  if (!existsSync7(indexPath) || lstatSync8(indexPath).isSymbolicLink() || !lstatSync8(indexPath).isFile()) {
     throw new CliError("RUNTIME", `the local '${BOARD_BRANCH}' worktree is not a valid bundle (root index.md missing)`);
   }
   pushBoardUpstream(boardPath);
@@ -106053,7 +106641,7 @@ async function loadClaimPolicy(boardPath) {
     const originSha = resolveOriginRef(boardPath);
     if (originSha === null) return INACTIVE_POLICY;
     const bundle = { root: boardPath };
-    const [registry2, okfVersion] = await Promise.all([loadKinds(bundle), readBundleOkfVersion(bundle)]);
+    const [registry2, okfVersion] = await Promise.all([loadKinds(bundle), readBundleOkfVersion2(bundle)]);
     if (registry2.kinds.size === 0) return INACTIVE_POLICY;
     const resolved = /* @__PURE__ */ new Map();
     return {
@@ -106118,7 +106706,7 @@ var init_claim_conflict = __esm({
 });
 
 // src/commands/sync/converge.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 function cap2(rows, limit) {
   const bounded = limit > 0 ? rows.slice(0, limit) : rows;
   return { shown: bounded.length, total: rows.length, rows: bounded };
@@ -106216,7 +106804,7 @@ function analyzeConflict(boardPath, c, policy) {
   const keptOnly = { meta: meta3, frontmatterDiffers: [] };
   if (c.exportPath === null || !c.landed) return keptOnly;
   try {
-    const local = parseMarkdown(readFileSync12(c.exportPath, "utf8"), c.relPath);
+    const local = parseMarkdown(readFileSync13(c.exportPath, "utf8"), c.relPath);
     const localFm = local.frontmatter;
     const keys = /* @__PURE__ */ new Set([...Object.keys(localFm), ...Object.keys(keptFm)]);
     keys.delete("timestamp");
@@ -107439,7 +108027,7 @@ var init_skill_compatibility = __esm({
 
 // src/commands/skill.ts
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync8, readFileSync as readFileSync13, readdirSync as readdirSync3, realpathSync as realpathSync15, renameSync as renameSync7, rmSync as rmSync5, rmdirSync as rmdirSync3 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync9, readFileSync as readFileSync14, readdirSync as readdirSync3, realpathSync as realpathSync15, renameSync as renameSync7, rmSync as rmSync5, rmdirSync as rmdirSync3 } from "node:fs";
 import { homedir as homedir17 } from "node:os";
 import path38 from "node:path";
 import { dirname as dirname6, join as join12 } from "node:path";
@@ -107479,7 +108067,7 @@ function resolveSkillAssets(executable) {
   const fileSha256 = Object.fromEntries(
     files.map((relativePath) => [
       relativePath,
-      `sha256:${createHash10("sha256").update(readFileSync13(join12(root, relativePath))).digest("hex")}`
+      `sha256:${createHash10("sha256").update(readFileSync14(join12(root, relativePath))).digest("hex")}`
     ])
   );
   return {
@@ -107549,7 +108137,7 @@ function skillTargetPairIdentity(canonicalDir, legacyDir, platform = process.pla
 function nonDirectoryRefusal(dir) {
   let stats;
   try {
-    stats = lstatSync8(dir);
+    stats = lstatSync9(dir);
   } catch {
     return void 0;
   }
@@ -107559,7 +108147,7 @@ function nonDirectoryRefusal(dir) {
 }
 function isSymlink(p2) {
   try {
-    return lstatSync8(p2).isSymbolicLink();
+    return lstatSync9(p2).isSymbolicLink();
   } catch {
     return false;
   }
@@ -107586,13 +108174,16 @@ function readManifest(dir) {
   const manifestPath = join12(dir, SKILL_MANIFEST_FILENAME);
   let manifestStats;
   try {
-    manifestStats = lstatSync8(manifestPath);
+    manifestStats = lstatSync9(manifestPath);
   } catch {
     return void 0;
   }
   if (manifestStats.isSymbolicLink() || !manifestStats.isFile()) return null;
+  const read = readRegularFileTextNoFollowSync(manifestPath);
+  if (read.state === "missing") return void 0;
+  if (read.state === "unsafe") return null;
   try {
-    return parseOwnedSkillManifest(JSON.parse(readFileSync13(manifestPath, "utf8")));
+    return parseOwnedSkillManifest(JSON.parse(read.text));
   } catch {
     return null;
   }
@@ -107633,7 +108224,7 @@ function unmanagedExtras(dir, managed) {
 }
 function isDirectory(p2) {
   try {
-    return lstatSync8(p2).isDirectory();
+    return lstatSync9(p2).isDirectory();
   } catch {
     return false;
   }
@@ -107705,19 +108296,25 @@ function installIntoDir(dir, assets, prepared) {
     atomicWriteFileSync(manifestPath, content3);
     changed = true;
   };
-  const currentManifest = !isSymlink(manifestPath) && existsSync8(manifestPath) ? readFileSync13(manifestPath, "utf8") : void 0;
+  const readManifestText = () => {
+    const read = readRegularFileTextNoFollowSync(manifestPath);
+    return read.state === "present" ? read.text : void 0;
+  };
+  const currentManifest = readManifestText();
   if (currentManifest !== transitionalManifest && currentManifest !== finalManifest) {
     writeManifest(transitionalManifest);
   }
   const wanted = new Set(assets.files);
   for (const relativePath of assets.files) {
-    const bytes = readFileSync13(join12(assets.root, relativePath));
+    const bytes = readFileSync14(join12(assets.root, relativePath));
     const destPath = join12(dir, ...relativePath.split("/"));
     const destIsLink = isSymlink(destPath);
     const destIsDir = !destIsLink && isDirectory(destPath);
-    const current = !destIsLink && !destIsDir && existsSync8(destPath) ? readFileSync13(destPath) : void 0;
-    if (destIsLink || destIsDir || current === void 0 || !bytes.equals(current)) {
-      if (destIsLink) rmSync5(destPath, { force: true });
+    const read = destIsLink || destIsDir ? void 0 : readRegularFileNoFollowSync(destPath);
+    const destIsIrregular = read?.state === "unsafe";
+    const current = read?.state === "present" ? read.bytes : void 0;
+    if (destIsLink || destIsDir || destIsIrregular || current === void 0 || !bytes.equals(current)) {
+      if (destIsLink || destIsIrregular) rmSync5(destPath, { force: true });
       if (destIsDir) rmdirSync3(destPath);
       atomicWriteFileSync(destPath, bytes);
       changed = true;
@@ -107729,7 +108326,7 @@ function installIntoDir(dir, assets, prepared) {
       changed = true;
     }
   }
-  const manifestAfterConverge = existsSync8(manifestPath) ? readFileSync13(manifestPath, "utf8") : void 0;
+  const manifestAfterConverge = readManifestText();
   if (manifestAfterConverge !== finalManifest) {
     writeManifest(finalManifest);
   }
@@ -107817,19 +108414,14 @@ function skillStatusForDir(dir, assets, installCommand = `${cliInvocation()} ski
     receiptDigestsMatch = manifest.kind === "legacy" || manifest.receipt_valid && manifest.file_sha256 !== null;
     for (const relativePath of assets.files) {
       const installedPath = join12(dir, ...relativePath.split("/"));
-      let regularFile = false;
-      try {
-        regularFile = lstatSync8(installedPath).isFile();
-      } catch {
-        regularFile = false;
-      }
-      if (!regularFile) {
+      const read = readRegularFileNoFollowSync(installedPath);
+      if (read.state !== "present") {
         assetsMatch = false;
         receiptDigestsMatch = false;
         break;
       }
-      const installed = readFileSync13(installedPath);
-      const shipped = readFileSync13(join12(assets.root, relativePath));
+      const installed = read.bytes;
+      const shipped = readFileSync14(join12(assets.root, relativePath));
       if (!installed.equals(shipped)) assetsMatch = false;
       if (manifest.kind === "v2" && manifest.file_sha256?.[relativePath] !== `sha256:${createHash10("sha256").update(installed).digest("hex")}`) {
         receiptDigestsMatch = false;
@@ -108195,6 +108787,7 @@ var init_skill = __esm({
     init_skill_compatibility();
     init_install_authority();
     init_install_scope();
+    init_nofollow_read();
     init_integration_receipt();
     SKILL_USAGE = `superbee skill \u2014 install this package's Agent Skill into host skill folders
 
@@ -108296,7 +108889,7 @@ async function defaultSummarizeBundle(dir, route) {
     return { root, unreadable: true };
   }
   try {
-    const docs = await queryHeads(bundle);
+    const docs = await queryHeads2(bundle);
     const { name, source } = await deriveBundleDisplayName(bundle);
     return { name, nameSource: source, ...summarizeDocs(docs, collapseHomeDirectory(bundle.root)) };
   } catch {
@@ -109360,7 +109953,7 @@ async function indexCommand(argv2, deps = {}) {
   const bundle = await openBundle(values.dir);
   const [{ name: displayName }, heads] = await Promise.all([
     deriveBundleDisplayName(bundle),
-    queryHeads(bundle)
+    queryHeads2(bundle)
   ]);
   const plan = planIndexProjection(displayName, heads);
   const prepared = await prepareIndexProjection(bundle, plan, { force: values.force });
@@ -109543,7 +110136,7 @@ async function artifact(argv2, deps = {}) {
     }
     let prior;
     try {
-      prior = await readDoc(bundle, supersedes);
+      prior = await readDoc2(bundle, supersedes);
     } catch {
       prior = void 0;
     }
@@ -109561,8 +110154,8 @@ async function artifact(argv2, deps = {}) {
   const body = supersedes ? `[supersedes](${supersedes.slice("artifacts/".length)}.md)
 ` : "";
   const [recordHeads, blobKeys] = await Promise.all([
-    queryHeads(bundle, { prefix: "artifacts/" }),
-    listBlobs(bundle, "artifacts/")
+    queryHeads2(bundle, { prefix: "artifacts/" }),
+    listBlobs2(bundle, "artifacts/")
   ]);
   const taken = /* @__PURE__ */ new Set([
     ...recordHeads.map((h2) => h2.id),
@@ -109573,7 +110166,7 @@ async function artifact(argv2, deps = {}) {
   let entryVersion;
   try {
     if (route) await assertResolvedLocalRouteIdentity(route);
-    entryVersion = await writeBlob(bundle, entryKey, bytes, "text/html", { expectedVersion: null });
+    entryVersion = await writeBlob2(bundle, entryKey, bytes, "text/html", { expectedVersion: null });
   } catch (err) {
     throw new CliError("RUNTIME", `could not write the artifact blob '${entryKey}': ${err instanceof Error ? err.message : String(err)}`);
   }