superbee 0.4.3-pre.9 → 0.4.4-pre.1

package/dist/publication-bridge.mjs

@@ -920,25 +920,25 @@ var require_pairs = __commonJS({
     var _toString = Object.prototype.toString;
     function resolveYamlPairs(data) {
       if (data === null) return true;
-      var index, length, pair, keys, result, object = data;
+      var index, length, pair, keys2, result, object = data;
       result = new Array(object.length);
       for (index = 0, length = object.length; index < length; index += 1) {
         pair = object[index];
         if (_toString.call(pair) !== "[object Object]") return false;
-        keys = Object.keys(pair);
-        if (keys.length !== 1) return false;
-        result[index] = [keys[0], pair[keys[0]]];
+        keys2 = Object.keys(pair);
+        if (keys2.length !== 1) return false;
+        result[index] = [keys2[0], pair[keys2[0]]];
       }
       return true;
     }
     function constructYamlPairs(data) {
       if (data === null) return [];
-      var index, length, pair, keys, result, object = data;
+      var index, length, pair, keys2, result, object = data;
       result = new Array(object.length);
       for (index = 0, length = object.length; index < length; index += 1) {
         pair = object[index];
-        keys = Object.keys(pair);
-        result[index] = [keys[0], pair[keys[0]]];
+        keys2 = Object.keys(pair);
+        result[index] = [keys2[0], pair[keys2[0]]];
       }
       return result;
     }
@@ -2345,12 +2345,12 @@ var require_dumper = __commonJS({
       "OFF"
     ];
     function compileStyleMap(schema, map) {
-      var result, keys, index, length, tag, style, type;
+      var result, keys2, index, length, tag, style, type;
       if (map === null) return {};
       result = {};
-      keys = Object.keys(map);
-      for (index = 0, length = keys.length; index < length; index += 1) {
-        tag = keys[index];
+      keys2 = Object.keys(map);
+      for (index = 0, length = keys2.length; index < length; index += 1) {
+        tag = keys2[index];
         style = String(map[tag]);
         if (tag.slice(0, 2) === "!!") {
           tag = "tag:yaml.org,2002:" + tag.slice(2);
@@ -2874,7 +2874,38 @@ import { createHash as createHash3 } from "node:crypto";
 // ../core/src/backend.ts
 import path3 from "node:path";
 
-// ../core/src/frontmatter.ts
+// ../core/src/errors.ts
+var InvalidInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidInputError";
+  }
+};
+var FilesystemIdentityAliasError = class extends InvalidInputError {
+  rel;
+  segment;
+  constructor(rel, segment) {
+    super(
+      `Path '${rel}' does not match the exact spelling of an existing filesystem entry at segment '${segment}'; ids that differ only by case or Unicode normalization cannot share one file.`
+    );
+    this.name = "FilesystemIdentityAliasError";
+    this.rel = rel;
+    this.segment = segment;
+  }
+};
+var ConcurrentReplacementError = class extends Error {
+  rel;
+  /** Optional bounded backoff hint for a transient host condition; ordinary observation races use zero. */
+  retryAfterMs;
+  constructor(rel, attempts, retryAfterMs = 0) {
+    super(`Path '${rel}' could not be bound to one stable entry during ${attempts} filesystem attempt(s); retry.`);
+    this.name = "ConcurrentReplacementError";
+    this.rel = rel;
+    this.retryAfterMs = retryAfterMs;
+  }
+};
+
+// ../core/src/portable-frontmatter.ts
 var import_js_yaml = __toESM(require_js_yaml2(), 1);
 
 // ../core/src/frontmatter-contract.ts
@@ -2922,261 +2953,448 @@ function splitLeadingFrontmatter(raw, context) {
   throw new MalformedDocumentError(context, new Error("unterminated YAML frontmatter delimiter"));
 }
 
-// ../core/src/frontmatter.ts
-var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
-function requireYamlTimestampType() {
-  const type = import_js_yaml.default.DEFAULT_SAFE_SCHEMA.implicit.find(
-    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
-  );
-  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
-  return type;
-}
-var yamlTimestampType = requireYamlTimestampType();
-var stringTimestampType = new import_js_yaml.default.Type(YAML_TIMESTAMP_TAG, {
-  kind: "scalar",
-  resolve: (value) => yamlTimestampType.resolve(value),
-  construct: (value) => value
-});
-var losslessDateSchema = new import_js_yaml.default.Schema({
-  include: [import_js_yaml.default.DEFAULT_SAFE_SCHEMA],
-  implicit: [stringTimestampType]
-});
-var yamlEngine = {
-  parse(input) {
-    return import_js_yaml.default.safeLoad(input, { schema: losslessDateSchema }) ?? {};
-  }
-};
-function normalizeFrontmatter(data, okfVersion) {
-  const out = { ...data };
-  if (okfVersion === "0.2") return out;
-  const value = out.timestamp;
-  if (value instanceof Date) {
-    out.timestamp = value.toISOString();
-  } else if (typeof value === "number" && Number.isFinite(value)) {
-    out.timestamp = new Date(value).toISOString();
-  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
-    const parsed = yamlTimestampType.construct(value);
-    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
-  }
-  return out;
-}
-function parseMarkdown(raw, context, options = {}) {
+// ../core/src/portable-frontmatter.ts
+function parseLeadingFrontmatter(raw, context) {
   const split = splitLeadingFrontmatter(raw, context);
-  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
-  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
-}
-function parseFrontmatter(source, context, options = {}) {
-  let parsed;
+  if (!("yamlSource" in split)) return {};
   try {
-    parsed = yamlEngine.parse(source);
-  } catch (err) {
-    throw new MalformedDocumentError(context, err);
+    const parsed = import_js_yaml.default.safeLoad(split.yamlSource);
+    if (parsed === void 0 || parsed === null) return {};
+    if (typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new TypeError("YAML frontmatter must be a mapping");
+    }
+    return parsed;
+  } catch (error) {
+    if (error instanceof MalformedDocumentError) throw error;
+    throw new MalformedDocumentError(context, error);
   }
-  return normalizeFrontmatter(parsed, options.okfVersion);
 }
-function stringifyFrontmatter(data) {
-  return import_js_yaml.default.safeDump(data).trim();
+
+// ../core/src/paths.ts
+var RESERVED_FILENAMES = ["index.md", "log.md"];
+function compareStorageKeys(a, b) {
+  const primary = a.localeCompare(b);
+  if (primary !== 0 || a === b) return primary;
+  const left = Array.from(a, (character) => character.codePointAt(0));
+  const right = Array.from(b, (character) => character.codePointAt(0));
+  for (let i = 0; i < Math.min(left.length, right.length); i++) {
+    if (left[i] !== right[i]) return left[i] - right[i];
+  }
+  return left.length - right.length;
 }
-function normalizeDocumentBodyForStorage(body) {
-  return body.endsWith("\n") ? body : `${body}
-`;
+function assertPortablePath(value, label) {
+  if (/[\u0000-\u001f\u007f]/u.test(value) || /^[a-z]:/i.test(value)) {
+    throw new InvalidInputError(`${label} must not contain controls or start with a drive prefix.`);
+  }
+  if (value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new InvalidInputError(`${label} must be canonical and bundle-relative.`);
+  }
 }
-function stringifyWithData(data, body) {
-  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
+function assertSafeReservedFilename(name) {
+  if (!RESERVED_FILENAMES.includes(name)) {
+    throw new InvalidInputError("Reserved filename must be index.md or log.md.");
+  }
 }
-function stringifyWithSerializedFrontmatter(dumped, body) {
-  const content = body ?? "";
-  const newline = (value) => value.endsWith("\n") ? value : `${value}
-`;
-  if (dumped === "{}") return normalizeDocumentBodyForStorage(content);
-  return `---
-${newline(dumped)}---
-${normalizeDocumentBodyForStorage(content)}`;
+function toPosix(p) {
+  return p.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
 }
-function stringifyDoc(frontmatter2, body) {
-  return stringifyWithData(frontmatter2, body);
+function isReservedFile(relPath) {
+  const base = toPosix(relPath).split("/").pop() ?? "";
+  return RESERVED_FILENAMES.includes(base);
 }
-
-// ../core/src/meaningful-change-time.ts
-function meaningfulChangeTimeField(frontmatter2) {
-  const generated = frontmatter2.generated;
-  if (generated !== null && typeof generated === "object" && !Array.isArray(generated) && generated.at !== void 0) return "generated.at";
-  return "timestamp";
+function conceptIdFromPath(relPath) {
+  const norm = toPosix(relPath).replace(/^\.?\//, "").split("/").filter((segment) => segment !== ".").join("/");
+  return norm.endsWith(".md") ? norm.slice(0, -3) : norm;
 }
-function meaningfulChangeTimeValue(frontmatter2) {
-  return meaningfulChangeTimeField(frontmatter2) === "generated.at" ? frontmatter2.generated.at : frontmatter2.timestamp;
+function pathFromConceptId(id) {
+  assertSafeConceptId(id);
+  return `${id}.md`;
 }
-
-// ../core/src/errors.ts
-var InvalidInputError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "InvalidInputError";
+function assertSafeConceptId(id) {
+  if (typeof id !== "string" || id.trim() === "") {
+    throw new InvalidInputError("Concept id must be a non-empty string.");
   }
-};
-var FilesystemIdentityAliasError = class extends InvalidInputError {
-  rel;
-  segment;
-  constructor(rel, segment) {
-    super(
-      `Path '${rel}' does not match the exact spelling of an existing filesystem entry at segment '${segment}'; ids that differ only by case or Unicode normalization cannot share one file.`
+  assertPortablePath(id, "Concept id");
+  const segments = id.split("/");
+  if (segments.slice(0, -1).some((seg) => seg.toLowerCase().endsWith(".md"))) {
+    throw new InvalidInputError(
+      `Concept id must not contain a non-final segment ending in '.md': '${id}' (it collides with a concept file at that path).`
     );
-    this.name = "FilesystemIdentityAliasError";
-    this.rel = rel;
-    this.segment = segment;
   }
-};
-var ConcurrentReplacementError = class extends Error {
-  rel;
-  /** Optional bounded backoff hint for a transient host condition; ordinary observation races use zero. */
-  retryAfterMs;
-  constructor(rel, attempts, retryAfterMs = 0) {
-    super(`Path '${rel}' could not be bound to one stable entry during ${attempts} filesystem attempt(s); retry.`);
-    this.name = "ConcurrentReplacementError";
-    this.rel = rel;
-    this.retryAfterMs = retryAfterMs;
+}
+var FORMAT_AT_EDGE = new RegExp("^\\p{Cf}|\\p{Cf}$", "u");
+var FORMAT_INSIDE = new RegExp("(?![\\u200c\\u200d])\\p{Cf}", "u");
+function assertSafeBlobKey(key) {
+  if (typeof key !== "string" || key.trim() === "") {
+    throw new InvalidInputError("Blob key must be a non-empty string.");
   }
-};
+  assertPortablePath(key, "Blob key");
+  const segments = key.split("/");
+  if (segments.some((seg) => seg.startsWith("."))) {
+    throw new InvalidInputError(`Blob key must not contain dot-prefixed segments: '${key}'.`);
+  }
+  if (segments.some((seg) => seg.toLowerCase().endsWith(".md"))) {
+    throw new InvalidInputError(
+      `Blob key '${key}' has a path segment ending in '.md' (checked case-insensitively, at any depth), which collides with the concept-document namespace \u2014 write it as a doc instead.`
+    );
+  }
+}
+function assertSafeReservedDir(dir) {
+  if (typeof dir !== "string") {
+    throw new InvalidInputError("Reserved-file directory must be a string.");
+  }
+  if (dir !== "") assertPortablePath(dir, "Reserved-file directory");
+}
 
-// ../core/src/verification.ts
-var TRUST_TIERS = Object.freeze([
-  "unverified",
-  "machine-confirmed",
-  "human-reviewed"
+// ../core/src/sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
 ]);
-var ISO_INSTANT = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2})(?::?(\d{2}))?)$/;
-function parseIsoInstant(raw, rounding = "truncate") {
-  const match = ISO_INSTANT.exec(raw);
-  if (!match) return null;
-  const [, y, mo, d, h, mi, sec = "0", frac = "0", zulu, sign, oh, om = "0"] = match;
-  const year = Number(y);
-  const month = Number(mo);
-  const day = Number(d);
-  const hour = Number(h);
-  const minute = Number(mi);
-  const second = Number(sec);
-  if (month < 1 || month > 12) return null;
-  const probe = /* @__PURE__ */ new Date(0);
-  probe.setUTCFullYear(year, month, 0);
-  if (day < 1 || day > probe.getUTCDate()) return null;
-  if (hour > 23 || minute > 59 || second > 59) return null;
-  let offsetMinutes = 0;
-  if (!zulu) {
-    const offsetHours = Number(oh);
-    const offsetMins = Number(om);
-    if (offsetHours > 23 || offsetMins > 59) return null;
-    offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMins);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+var encoder = new TextEncoder();
+function rotr(value, bits) {
+  return value >>> bits | value << 32 - bits;
+}
+function compress(h, w, view, offset) {
+  for (let i = 0; i < 16; i++) {
+    w[i] = view.getUint32(offset + i * 4);
   }
-  const millis = Number(frac.padEnd(3, "0").slice(0, 3));
-  const instant = /* @__PURE__ */ new Date(0);
-  instant.setUTCFullYear(year, month - 1, day);
-  instant.setUTCHours(hour, minute, second, millis);
-  const remainder = rounding === "ceil" && /[1-9]/.test(frac.slice(3)) ? 1 : 0;
-  return instant.getTime() - offsetMinutes * 6e4 + remainder;
+  for (let i = 16; i < 64; i++) {
+    const w15 = w[i - 15];
+    const w2 = w[i - 2];
+    const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+    const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+    w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+  }
+  let a = h[0];
+  let b = h[1];
+  let c = h[2];
+  let d = h[3];
+  let e = h[4];
+  let f = h[5];
+  let g = h[6];
+  let hh = h[7];
+  for (let i = 0; i < 64; i++) {
+    const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+    const ch = e & f ^ ~e & g;
+    const t1 = hh + S1 + ch + K[i] + w[i] >>> 0;
+    const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+    const maj = a & b ^ a & c ^ b & c;
+    const t2 = S0 + maj >>> 0;
+    hh = g;
+    g = f;
+    f = e;
+    e = d + t1 >>> 0;
+    d = c;
+    c = b;
+    b = a;
+    a = t1 + t2 >>> 0;
+  }
+  h[0] = h[0] + a >>> 0;
+  h[1] = h[1] + b >>> 0;
+  h[2] = h[2] + c >>> 0;
+  h[3] = h[3] + d >>> 0;
+  h[4] = h[4] + e >>> 0;
+  h[5] = h[5] + f >>> 0;
+  h[6] = h[6] + g >>> 0;
+  h[7] = h[7] + hh >>> 0;
 }
-
-// ../core/src/freshness.ts
-function parseTimestamp(ts, okfVersion) {
-  if (okfVersion === "0.2") return typeof ts === "string" ? parseIsoInstant(ts) : null;
-  if (ts instanceof Date) {
-    const ms2 = ts.getTime();
-    return Number.isNaN(ms2) ? null : ms2;
+function sha256HexOfBytes(bytes) {
+  const h = new Uint32Array(INITIAL_STATE);
+  const w = new Uint32Array(64);
+  const length = bytes.byteLength;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, length);
+  const fullBlocks = length >>> 6;
+  for (let block = 0; block < fullBlocks; block++) {
+    compress(h, w, view, block * 64);
   }
-  if (typeof ts === "number") {
-    return Number.isFinite(ts) ? ts : null;
+  const remaining = length - fullBlocks * 64;
+  const tail = new Uint8Array(remaining + 1 + 8 > 64 ? 128 : 64);
+  tail.set(bytes.subarray(fullBlocks * 64));
+  tail[remaining] = 128;
+  const tailView = new DataView(tail.buffer);
+  const bitLengthHigh = Math.floor(length / 536870912);
+  const bitLengthLow = length << 3 >>> 0;
+  tailView.setUint32(tail.length - 8, bitLengthHigh);
+  tailView.setUint32(tail.length - 4, bitLengthLow);
+  for (let offset = 0; offset < tail.length; offset += 64) {
+    compress(h, w, tailView, offset);
   }
-  if (typeof ts !== "string" || ts.trim() === "") return null;
-  const ms = Date.parse(ts);
-  return Number.isNaN(ms) ? null : ms;
+  let hex = "";
+  for (let i = 0; i < 8; i++) {
+    hex += h[i].toString(16).padStart(8, "0");
+  }
+  return hex;
 }
-
-// ../core/src/okf-lifecycle.ts
-var OKF_LIFECYCLE_STATUSES = Object.freeze(["draft", "stable", "deprecated"]);
-function isOkfLifecycleStatus(value) {
-  return typeof value === "string" && OKF_LIFECYCLE_STATUSES.includes(value);
+function sha256HexOfUtf8(input) {
+  return sha256HexOfBytes(encoder.encode(input));
 }
 
-// ../core/src/mutation-attribution.ts
-var SUPERBEE_UPDATED_BY_FIELD = "superbee_updated_by";
-function nonEmptyString(value) {
-  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+// ../core/src/inventory-guard.ts
+var INVENTORY_GUARD_DOMAIN = "cooperating-local-writers-v1";
+var InventoryGuardUnsupported = class extends Error {
+  written = false;
+  reason;
+  constructor(reason) {
+    super(`Inventory guard unsupported: ${reason}`);
+    this.name = "InventoryGuardUnsupported";
+    this.reason = reason;
+  }
+};
+var InventoryGuardConflict = class extends Error {
+  written = false;
+  reason;
+  constructor(reason) {
+    super(`Inventory guard premise changed: ${reason}`);
+    this.name = "InventoryGuardConflict";
+    this.reason = reason;
+  }
+};
+var capabilityOwners = /* @__PURE__ */ new WeakMap();
+function bindInventoryGuard(owner, guard) {
+  capabilityOwners.set(guard, owner);
+  return guard;
+}
+function assertInventoryGuardBound(count) {
+  if (count > 1e4) throw new InventoryGuardUnsupported("inventory_document_bound");
+}
+function copyData(value, active = /* @__PURE__ */ new Set(), budget = { nodes: 1e5 }) {
+  if (--budget.nodes < 0) throw new InvalidInputError("Inventory guard input exceeds its data bound.");
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value !== "object") throw new InvalidInputError("Inventory guard accepts finite plain data only.");
+  if (active.has(value)) throw new InvalidInputError("Inventory guard input is cyclic.");
+  const array = Array.isArray(value);
+  if (Object.getPrototypeOf(value) !== (array ? Array.prototype : Object.prototype) && Object.getPrototypeOf(value) !== null) {
+    throw new InvalidInputError("Inventory guard accepts plain objects and arrays only.");
+  }
+  active.add(value);
+  const result = array ? [] : /* @__PURE__ */ Object.create(null);
+  if (array && Object.keys(value).length !== value.length) throw new InvalidInputError("Inventory guard input cannot carry sparse arrays or extra keys.");
+  for (const key of Reflect.ownKeys(value)) {
+    if (array && key === "length") continue;
+    if (array && (typeof key !== "string" || !/^(0|[1-9][0-9]*)$/.test(key))) throw new InvalidInputError("Inventory guard arrays require indexed data only.");
+    if (typeof key !== "string") throw new InvalidInputError("Inventory guard input cannot carry symbol keys.");
+    const property = Object.getOwnPropertyDescriptor(value, key);
+    if (!property.enumerable || !("value" in property)) throw new InvalidInputError("Inventory guard input cannot carry accessors or hidden data.");
+    Object.defineProperty(result, key, { value: copyData(property.value, active, budget), enumerable: true, configurable: true, writable: true });
+  }
+  if (array && result.length !== value.length) throw new InvalidInputError("Inventory guard input cannot carry sparse arrays.");
+  active.delete(value);
+  return result;
+}
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new InvalidInputError("Inventory guard expected an object.");
+  return value;
 }
-function mutationActorFromFrontmatter(frontmatter2) {
-  return nonEmptyString(frontmatter2[SUPERBEE_UPDATED_BY_FIELD]) ?? nonEmptyString(frontmatter2.updated_by) ?? nonEmptyString(frontmatter2.actor);
+function keys(value, allowed) {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) throw new InvalidInputError("Inventory guard input has unsupported fields.");
+}
+function version(value) {
+  if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value)) throw new InvalidInputError("Inventory guard requires exact content versions.");
+}
+function captureInventoryGuardRequest(input) {
+  const data = record(copyData(input));
+  keys(data, ["target", "domain", "inventory", "id", "expectedVersion", "doc", "options"]);
+  const target = record(data.target);
+  keys(target, ["contract", "domain", "adapter", "store", "root_version", "edition"]);
+  if (target.contract !== "inventory-guard/v1" || target.domain !== INVENTORY_GUARD_DOMAIN || data.domain !== INVENTORY_GUARD_DOMAIN) {
+    throw new InventoryGuardUnsupported("domain_or_contract");
+  }
+  if (!["memory", "filesystem"].includes(String(target.adapter)) || typeof target.store !== "string" || target.store.length === 0 || !["0.1", "0.2"].includes(String(target.edition))) throw new InvalidInputError("Invalid inventory guard target.");
+  version(target.root_version);
+  if (typeof data.id !== "string") throw new InvalidInputError("Inventory guard requires a target id.");
+  assertSafeConceptId(data.id);
+  if (isReservedFile(pathFromConceptId(data.id))) throw new InvalidInputError("Inventory guard target must be a concept.");
+  version(data.expectedVersion);
+  if (!Array.isArray(data.inventory)) throw new InvalidInputError("Inventory guard requires a complete inventory.");
+  assertInventoryGuardBound(data.inventory.length);
+  let previous;
+  for (const raw of data.inventory) {
+    const row = record(raw);
+    keys(row, ["id", "version"]);
+    if (typeof row.id !== "string") throw new InvalidInputError("Inventory guard inventory id is invalid.");
+    assertSafeConceptId(row.id);
+    if (isReservedFile(pathFromConceptId(row.id)) || previous !== void 0 && compareStorageKeys(previous, row.id) >= 0) throw new InvalidInputError("Inventory guard inventory must be sorted, unique concepts.");
+    version(row.version);
+    previous = row.id;
+  }
+  if (!data.inventory.some((row) => row.id === data.id && row.version === data.expectedVersion)) throw new InvalidInputError("Inventory guard target/version is missing from inventory.");
+  const doc = record(data.doc);
+  keys(doc, ["id", "frontmatter", "body"]);
+  if (doc.id !== data.id || typeof doc.body !== "string") throw new InvalidInputError("Inventory guard candidate identity/body is invalid.");
+  record(doc.frontmatter);
+  if (data.options !== void 0) {
+    const options = record(data.options);
+    keys(options, ["actor", "agent"]);
+    if (Object.values(options).some((value) => typeof value !== "string")) throw new InvalidInputError("Inventory guard attribution must be strings.");
+  }
+  return data;
+}
+function guardEdition(content) {
+  if (content === null) throw new InventoryGuardUnsupported("root_metadata_absent");
+  const edition = parseLeadingFrontmatter(content, "index.md").okf_version;
+  if (edition !== "0.1" && edition !== "0.2") throw new InventoryGuardUnsupported("root_edition_unestablished");
+  return edition;
+}
+function compareInventoryPremises(expected, current, inventory) {
+  if (expected.target.adapter !== current.adapter || expected.target.store !== current.store) throw new InventoryGuardConflict("identity");
+  if (expected.target.edition !== current.edition) throw new InventoryGuardConflict("edition");
+  if (expected.target.root_version !== current.root_version) throw new InventoryGuardConflict("root_metadata");
+  if (expected.inventory.length !== inventory.length || expected.inventory.some((row, index) => row.id !== inventory[index]?.id)) throw new InventoryGuardConflict("membership");
+  if (expected.inventory.some((row, index) => row.version !== inventory[index].version)) throw new InventoryGuardConflict("version");
+  if (!inventory.some((row) => row.id === expected.id && row.version === expected.expectedVersion)) throw new InventoryGuardConflict("target_version");
+}
+function inventoryDigest(inventory) {
+  return `sha256:${sha256HexOfUtf8(JSON.stringify(inventory.map((row) => [row.id, row.version])))}`;
 }
 
-// ../core/src/paths.ts
-var RESERVED_FILENAMES = ["index.md", "log.md"];
-function compareStorageKeys(a, b) {
-  const primary = a.localeCompare(b);
-  if (primary !== 0 || a === b) return primary;
-  const left = Array.from(a, (character) => character.codePointAt(0));
-  const right = Array.from(b, (character) => character.codePointAt(0));
-  for (let i = 0; i < Math.min(left.length, right.length); i++) {
-    if (left[i] !== right[i]) return left[i] - right[i];
-  }
-  return left.length - right.length;
+// ../core/src/frontmatter.ts
+var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
+var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
+function requireYamlTimestampType() {
+  const type = import_js_yaml2.default.DEFAULT_SAFE_SCHEMA.implicit.find(
+    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
+  );
+  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
+  return type;
 }
-function assertPortablePath(value, label) {
-  if (/[\u0000-\u001f\u007f]/u.test(value) || /^[a-z]:/i.test(value)) {
-    throw new InvalidInputError(`${label} must not contain controls or start with a drive prefix.`);
-  }
-  if (value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
-    throw new InvalidInputError(`${label} must be canonical and bundle-relative.`);
+var yamlTimestampType = requireYamlTimestampType();
+var stringTimestampType = new import_js_yaml2.default.Type(YAML_TIMESTAMP_TAG, {
+  kind: "scalar",
+  resolve: (value) => yamlTimestampType.resolve(value),
+  construct: (value) => value
+});
+var losslessDateSchema = new import_js_yaml2.default.Schema({
+  include: [import_js_yaml2.default.DEFAULT_SAFE_SCHEMA],
+  implicit: [stringTimestampType]
+});
+var yamlEngine = {
+  parse(input) {
+    return import_js_yaml2.default.safeLoad(input, { schema: losslessDateSchema }) ?? {};
   }
-}
-function assertSafeReservedFilename(name) {
-  if (!RESERVED_FILENAMES.includes(name)) {
-    throw new InvalidInputError("Reserved filename must be index.md or log.md.");
+};
+function normalizeFrontmatter(data, options) {
+  const out = { ...data };
+  if (options.preserveTimestamp || options.okfVersion === "0.2") return out;
+  const value = out.timestamp;
+  if (value instanceof Date) {
+    out.timestamp = value.toISOString();
+  } else if (typeof value === "number" && Number.isFinite(value)) {
+    out.timestamp = new Date(value).toISOString();
+  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
+    const parsed = yamlTimestampType.construct(value);
+    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
   }
+  return out;
 }
-function toPosix(p) {
-  return p.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+function parseMarkdown(raw, context, options = {}) {
+  const split = splitLeadingFrontmatter(raw, context);
+  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
+  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
 }
-function isReservedFile(relPath) {
-  const base = toPosix(relPath).split("/").pop() ?? "";
-  return RESERVED_FILENAMES.includes(base);
+function parseFrontmatter(source, context, options = {}) {
+  let parsed;
+  try {
+    parsed = yamlEngine.parse(source);
+  } catch (err) {
+    throw new MalformedDocumentError(context, err);
+  }
+  return normalizeFrontmatter(parsed, options);
 }
-function conceptIdFromPath(relPath) {
-  const norm = toPosix(relPath).replace(/^\.?\//, "").split("/").filter((segment) => segment !== ".").join("/");
-  return norm.endsWith(".md") ? norm.slice(0, -3) : norm;
+function stringifyFrontmatter(data) {
+  return import_js_yaml2.default.safeDump(data).trim();
 }
-function pathFromConceptId(id) {
-  assertSafeConceptId(id);
-  return `${id}.md`;
+function normalizeDocumentBodyForStorage(body) {
+  return body.endsWith("\n") ? body : `${body}
+`;
 }
-function assertSafeConceptId(id) {
-  if (typeof id !== "string" || id.trim() === "") {
-    throw new InvalidInputError("Concept id must be a non-empty string.");
-  }
-  assertPortablePath(id, "Concept id");
-  const segments = id.split("/");
-  if (segments.slice(0, -1).some((seg) => seg.toLowerCase().endsWith(".md"))) {
-    throw new InvalidInputError(
-      `Concept id must not contain a non-final segment ending in '.md': '${id}' (it collides with a concept file at that path).`
-    );
-  }
+function stringifyWithData(data, body) {
+  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
 }
-function assertSafeBlobKey(key) {
-  if (typeof key !== "string" || key.trim() === "") {
-    throw new InvalidInputError("Blob key must be a non-empty string.");
-  }
-  assertPortablePath(key, "Blob key");
-  const segments = key.split("/");
-  if (segments.some((seg) => seg.startsWith("."))) {
-    throw new InvalidInputError(`Blob key must not contain dot-prefixed segments: '${key}'.`);
-  }
-  if (segments.some((seg) => seg.toLowerCase().endsWith(".md"))) {
-    throw new InvalidInputError(
-      `Blob key '${key}' has a path segment ending in '.md' (checked case-insensitively, at any depth), which collides with the concept-document namespace \u2014 write it as a doc instead.`
-    );
-  }
+function stringifyWithSerializedFrontmatter(dumped, body) {
+  const content = body ?? "";
+  const newline = (value) => value.endsWith("\n") ? value : `${value}
+`;
+  if (dumped === "{}") return normalizeDocumentBodyForStorage(content);
+  return `---
+${newline(dumped)}---
+${normalizeDocumentBodyForStorage(content)}`;
 }
-function assertSafeReservedDir(dir) {
-  if (typeof dir !== "string") {
-    throw new InvalidInputError("Reserved-file directory must be a string.");
-  }
-  if (dir !== "") assertPortablePath(dir, "Reserved-file directory");
+function stringifyDoc(frontmatter2, body) {
+  return stringifyWithData(frontmatter2, body);
 }
 
 // ../core/src/links.ts
@@ -3420,23 +3638,114 @@ function parseLinksFromDoc(doc) {
   }
   return links;
 }
-
-// ../core/src/portable-frontmatter.ts
-var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
-function parseLeadingFrontmatter(raw, context) {
-  const split = splitLeadingFrontmatter(raw, context);
-  if (!("yamlSource" in split)) return {};
-  try {
-    const parsed = import_js_yaml2.default.safeLoad(split.yamlSource);
-    if (parsed === void 0 || parsed === null) return {};
-    if (typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new TypeError("YAML frontmatter must be a mapping");
-    }
-    return parsed;
-  } catch (error) {
-    if (error instanceof MalformedDocumentError) throw error;
-    throw new MalformedDocumentError(context, error);
-  }
+
+// ../core/src/version-transport.ts
+function isContentVersion(value) {
+  return typeof value === "string" && /^sha256:[0-9a-f]{64}$/.test(value);
+}
+var VersionConflict = class extends Error {
+  name = "VersionConflict";
+  id;
+  expected;
+  actual;
+  constructor(id, expected, actual) {
+    super(
+      `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
+    );
+    this.id = id;
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+
+// ../core/src/meaningful-change-time.ts
+function meaningfulChangeTimeField(frontmatter2) {
+  const generated = frontmatter2.generated;
+  if (generated !== null && typeof generated === "object" && !Array.isArray(generated) && generated.at !== void 0) return "generated.at";
+  return "timestamp";
+}
+function meaningfulChangeTimeValue(frontmatter2) {
+  return meaningfulChangeTimeField(frontmatter2) === "generated.at" ? frontmatter2.generated.at : frontmatter2.timestamp;
+}
+
+// ../core/src/verification.ts
+var TRUST_TIERS = Object.freeze([
+  "unverified",
+  "machine-confirmed",
+  "human-reviewed"
+]);
+var ISO_INSTANT = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2})(?::?(\d{2}))?)$/;
+function parseIsoInstant(raw, rounding = "truncate") {
+  const match = ISO_INSTANT.exec(raw);
+  if (!match) return null;
+  const [, y, mo, d, h, mi, sec = "0", frac = "0", zulu, sign, oh, om = "0"] = match;
+  const year = Number(y);
+  const month = Number(mo);
+  const day = Number(d);
+  const hour = Number(h);
+  const minute = Number(mi);
+  const second = Number(sec);
+  if (month < 1 || month > 12) return null;
+  const probe = /* @__PURE__ */ new Date(0);
+  probe.setUTCFullYear(year, month, 0);
+  if (day < 1 || day > probe.getUTCDate()) return null;
+  if (hour > 23 || minute > 59 || second > 59) return null;
+  let offsetMinutes = 0;
+  if (!zulu) {
+    const offsetHours = Number(oh);
+    const offsetMins = Number(om);
+    if (offsetHours > 23 || offsetMins > 59) return null;
+    offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMins);
+  }
+  const millis = Number(frac.padEnd(3, "0").slice(0, 3));
+  const instant = /* @__PURE__ */ new Date(0);
+  instant.setUTCFullYear(year, month - 1, day);
+  instant.setUTCHours(hour, minute, second, millis);
+  const remainder = rounding === "ceil" && /[1-9]/.test(frac.slice(3)) ? 1 : 0;
+  return instant.getTime() - offsetMinutes * 6e4 + remainder;
+}
+
+// ../core/src/freshness.ts
+function parseTimestamp(ts, okfVersion) {
+  if (okfVersion === "0.2") return typeof ts === "string" ? parseIsoInstant(ts) : null;
+  if (ts instanceof Date) {
+    const ms2 = ts.getTime();
+    return Number.isNaN(ms2) ? null : ms2;
+  }
+  if (typeof ts === "number") {
+    return Number.isFinite(ts) ? ts : null;
+  }
+  if (typeof ts !== "string" || ts.trim() === "") return null;
+  const ms = Date.parse(ts);
+  return Number.isNaN(ms) ? null : ms;
+}
+
+// ../core/src/okf-authored-values.ts
+function isOkfRecord(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+// ../core/src/okf-lifecycle.ts
+var OKF_LIFECYCLE_STATUSES = Object.freeze(["draft", "stable", "deprecated"]);
+function isOkfLifecycleStatus(value) {
+  return typeof value === "string" && OKF_LIFECYCLE_STATUSES.includes(value);
+}
+
+// ../core/src/okf-standard-fields.ts
+var OKF_STANDARD_FIELD_NAMES = ["type", "title", "description", "resource", "tags", "status", "sources", "generated", "verified", "stale_after", "usage_window", "runtime", "computation", "parameters", "executor", "attester", "okf_version"];
+function isOkfStandardField(field) {
+  return OKF_STANDARD_FIELD_NAMES.includes(field);
+}
+
+// ../core/src/mutation-attribution.ts
+var SUPERBEE_UPDATED_BY_FIELD = "superbee_updated_by";
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function mutationActorFromFrontmatter(frontmatter2) {
+  return nonEmptyString(frontmatter2[SUPERBEE_UPDATED_BY_FIELD]) ?? nonEmptyString(frontmatter2.updated_by) ?? nonEmptyString(frontmatter2.actor);
 }
 
 // ../core/src/query-filter.ts
@@ -3460,13 +3769,22 @@ function matchesFilter(doc, filter) {
   }
   return true;
 }
-function matchesSourceIdentity(entry, identity) {
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+function sourceIdentityOf(entry) {
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return void 0;
   const row = entry;
+  const identity = {};
+  for (const key of ["resource", "id"]) {
+    if (Object.hasOwn(row, key) && typeof row[key] === "string") identity[key] = row[key];
+  }
+  return identity;
+}
+function matchesSourceIdentity(entry, identity) {
+  const own = sourceIdentityOf(entry);
+  if (!own) return false;
   for (const key of ["resource", "id"]) {
     const expected = identity[key];
     if (expected === void 0) continue;
-    if (!Object.hasOwn(row, key) || typeof row[key] !== "string" || row[key] !== expected) return false;
+    if (own[key] === void 0 || own[key] !== expected) return false;
   }
   return true;
 }
@@ -3535,10 +3853,10 @@ async function queryHeads(backend, filter = {}, options = {}) {
     rows.sort((a, b) => a.id.localeCompare(b.id));
     return rows;
   }
-  return (await scanMatching(backend, filter, options.onSkip)).map(({ doc, version }) => ({
+  return (await scanMatching(backend, filter, options.onSkip)).map(({ doc, version: version2 }) => ({
     id: doc.id,
     frontmatter: doc.frontmatter,
-    version
+    version: version2
   }));
 }
 function normalizeEdgeSelector(raw) {
@@ -3650,13 +3968,13 @@ function snapshotHostPolicy(input, seen = /* @__PURE__ */ new WeakMap()) {
   if (existing) return existing;
   const result = Array.isArray(input) ? [] : {};
   seen.set(input, result);
-  const keys = /* @__PURE__ */ new Set();
+  const keys2 = /* @__PURE__ */ new Set();
   for (let owner = input; owner && owner !== Object.prototype && owner !== Array.prototype; owner = Object.getPrototypeOf(owner)) {
     for (const key of Reflect.ownKeys(owner)) {
-      if (key !== "constructor" && !(Array.isArray(input) && key === "length")) keys.add(key);
+      if (key !== "constructor" && !(Array.isArray(input) && key === "length")) keys2.add(key);
     }
   }
-  for (const key of keys) {
+  for (const key of keys2) {
     const value = input[key];
     Object.defineProperty(result, key, {
       value: typeof value === "function" ? value.bind(result) : value && typeof value === "object" ? snapshotHostPolicy(value, seen) : value,
@@ -3781,14 +4099,14 @@ async function readOwnerRecord(lockPath) {
 }
 async function resolveOwnerRecord(lockPath, started, waitMs, pollMs) {
   while (true) {
-    const record = await readOwnerRecord(lockPath);
-    if (record.state !== "unreadable" || Date.now() - started >= waitMs) return record;
+    const record2 = await readOwnerRecord(lockPath);
+    if (record2.state !== "unreadable" || Date.now() - started >= waitMs) return record2;
     await delay(pollMs);
   }
 }
 async function readOwner(lockPath) {
-  const record = await readOwnerRecord(lockPath);
-  return record.state === "record" ? record.owner : null;
+  const record2 = await readOwnerRecord(lockPath);
+  return record2.state === "record" ? record2.owner : null;
 }
 function processExists(pid) {
   try {
@@ -3983,12 +4301,12 @@ async function claimLockPath(lockPath, owner, waitMs, pollMs, policy) {
 }
 async function rollBackOwnClaim(lockPath, owner, claimed, waitMs, pollMs, policy) {
   const started = Date.now();
-  const record = await resolveOwnerRecord(lockPath, started, waitMs, pollMs);
-  if (record.state === "record") {
-    if (record.owner.token === owner.token) await removeReleasedLock(lockPath, owner, started, waitMs, pollMs, policy);
+  const record2 = await resolveOwnerRecord(lockPath, started, waitMs, pollMs);
+  if (record2.state === "record") {
+    if (record2.owner.token === owner.token) await removeReleasedLock(lockPath, owner, started, waitMs, pollMs, policy);
     return;
   }
-  if (record.state === "unreadable" || !await isClaimedDirectory(lockPath, claimed)) return;
+  if (record2.state === "unreadable" || !await isClaimedDirectory(lockPath, claimed)) return;
   const remnant = releasedLockRemnantPath(lockPath, owner);
   await fs.rename(lockPath, remnant);
   await fs.rm(remnant, { recursive: true, force: true });
@@ -4151,12 +4469,62 @@ async function existingAnchor(resolved) {
     candidate = parent;
   }
 }
-async function identityKey(root, rel) {
-  const foldedRel = relSegments(rel).map(foldSegment).join("/");
+async function foldedPhysicalRoot(root) {
   const { anchor, tail } = await existingAnchor(path2.resolve(root));
   const anchorSegments = anchor.split(path2.sep).filter((segment, index) => index === 0 || segment !== "");
-  const foldedRoot = [...anchorSegments, ...tail].map(foldSegment).join("/");
-  return createHash2("sha256").update(`superbee-identity/v1\0${foldedRoot}\0${foldedRel}`).digest("hex");
+  return [...anchorSegments, ...tail].map(foldSegment).join("/");
+}
+async function identityKey(root, rel) {
+  const foldedRel = relSegments(rel).map(foldSegment).join("/");
+  return createHash2("sha256").update(`superbee-identity/v1\0${await foldedPhysicalRoot(root)}\0${foldedRel}`).digest("hex");
+}
+async function filesystemRootMutationKey(root) {
+  return createHash2("sha256").update(`superbee-root-mutation/v1\0${await foldedPhysicalRoot(root)}`).digest("hex");
+}
+async function filesystemRootWitness(port, root) {
+  const physical = await fs2.realpath(root);
+  const witnesses = [];
+  let current = physical;
+  for (; ; ) {
+    const witness = await port.probe(current);
+    if (!witness || witness.kind !== "directory") throw new InvalidInputError("Inventory guard root identity is unavailable.");
+    witnesses.push([current, witness.dev, witness.ino]);
+    const parent = path2.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return createHash2("sha256").update(JSON.stringify(witnesses)).digest("hex");
+}
+var rootMutationQueues = /* @__PURE__ */ new Map();
+function createFilesystemMutationCoordinator(_port, root, hostPolicy) {
+  const policy = captureFilesystemHostPolicy(hostPolicy);
+  let lockRoot;
+  const namespace = () => lockRoot ??= filesystemMutationLockRoot(root, policy);
+  return Object.freeze({
+    namespace,
+    async run(body) {
+      const key = await filesystemRootMutationKey(root);
+      const lockRoot2 = namespace();
+      const queueKey = `${lockRoot2}:${key}`;
+      const previous = rootMutationQueues.get(queueKey) ?? Promise.resolve();
+      const run = previous.then(async () => {
+        const release = await acquireFilesystemIdentityLock(key, root, { portableRoot: root, lockRoot: lockRoot2, hostPolicy: policy });
+        try {
+          return await body();
+        } finally {
+          await release();
+        }
+      });
+      const settled = run.then(() => {
+      }, () => {
+      });
+      rootMutationQueues.set(queueKey, settled);
+      void settled.then(() => {
+        if (rootMutationQueues.get(queueKey) === settled) rootMutationQueues.delete(queueKey);
+      });
+      return run;
+    }
+  });
 }
 function sameWitness(a, b) {
   return a.dev === b.dev && a.ino === b.ino;
@@ -4690,181 +5058,6 @@ function createNodeFilesystemIdentityPort(hostPolicy) {
   });
 }
 
-// ../core/src/sha256.ts
-var K = new Uint32Array([
-  1116352408,
-  1899447441,
-  3049323471,
-  3921009573,
-  961987163,
-  1508970993,
-  2453635748,
-  2870763221,
-  3624381080,
-  310598401,
-  607225278,
-  1426881987,
-  1925078388,
-  2162078206,
-  2614888103,
-  3248222580,
-  3835390401,
-  4022224774,
-  264347078,
-  604807628,
-  770255983,
-  1249150122,
-  1555081692,
-  1996064986,
-  2554220882,
-  2821834349,
-  2952996808,
-  3210313671,
-  3336571891,
-  3584528711,
-  113926993,
-  338241895,
-  666307205,
-  773529912,
-  1294757372,
-  1396182291,
-  1695183700,
-  1986661051,
-  2177026350,
-  2456956037,
-  2730485921,
-  2820302411,
-  3259730800,
-  3345764771,
-  3516065817,
-  3600352804,
-  4094571909,
-  275423344,
-  430227734,
-  506948616,
-  659060556,
-  883997877,
-  958139571,
-  1322822218,
-  1537002063,
-  1747873779,
-  1955562222,
-  2024104815,
-  2227730452,
-  2361852424,
-  2428436474,
-  2756734187,
-  3204031479,
-  3329325298
-]);
-var INITIAL_STATE = new Uint32Array([
-  1779033703,
-  3144134277,
-  1013904242,
-  2773480762,
-  1359893119,
-  2600822924,
-  528734635,
-  1541459225
-]);
-var encoder = new TextEncoder();
-function rotr(value, bits) {
-  return value >>> bits | value << 32 - bits;
-}
-function compress(h, w, view, offset) {
-  for (let i = 0; i < 16; i++) {
-    w[i] = view.getUint32(offset + i * 4);
-  }
-  for (let i = 16; i < 64; i++) {
-    const w15 = w[i - 15];
-    const w2 = w[i - 2];
-    const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
-    const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
-    w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
-  }
-  let a = h[0];
-  let b = h[1];
-  let c = h[2];
-  let d = h[3];
-  let e = h[4];
-  let f = h[5];
-  let g = h[6];
-  let hh = h[7];
-  for (let i = 0; i < 64; i++) {
-    const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
-    const ch = e & f ^ ~e & g;
-    const t1 = hh + S1 + ch + K[i] + w[i] >>> 0;
-    const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
-    const maj = a & b ^ a & c ^ b & c;
-    const t2 = S0 + maj >>> 0;
-    hh = g;
-    g = f;
-    f = e;
-    e = d + t1 >>> 0;
-    d = c;
-    c = b;
-    b = a;
-    a = t1 + t2 >>> 0;
-  }
-  h[0] = h[0] + a >>> 0;
-  h[1] = h[1] + b >>> 0;
-  h[2] = h[2] + c >>> 0;
-  h[3] = h[3] + d >>> 0;
-  h[4] = h[4] + e >>> 0;
-  h[5] = h[5] + f >>> 0;
-  h[6] = h[6] + g >>> 0;
-  h[7] = h[7] + hh >>> 0;
-}
-function sha256HexOfBytes(bytes) {
-  const h = new Uint32Array(INITIAL_STATE);
-  const w = new Uint32Array(64);
-  const length = bytes.byteLength;
-  const view = new DataView(bytes.buffer, bytes.byteOffset, length);
-  const fullBlocks = length >>> 6;
-  for (let block = 0; block < fullBlocks; block++) {
-    compress(h, w, view, block * 64);
-  }
-  const remaining = length - fullBlocks * 64;
-  const tail = new Uint8Array(remaining + 1 + 8 > 64 ? 128 : 64);
-  tail.set(bytes.subarray(fullBlocks * 64));
-  tail[remaining] = 128;
-  const tailView = new DataView(tail.buffer);
-  const bitLengthHigh = Math.floor(length / 536870912);
-  const bitLengthLow = length << 3 >>> 0;
-  tailView.setUint32(tail.length - 8, bitLengthHigh);
-  tailView.setUint32(tail.length - 4, bitLengthLow);
-  for (let offset = 0; offset < tail.length; offset += 64) {
-    compress(h, w, tailView, offset);
-  }
-  let hex = "";
-  for (let i = 0; i < 8; i++) {
-    hex += h[i].toString(16).padStart(8, "0");
-  }
-  return hex;
-}
-function sha256HexOfUtf8(input) {
-  return sha256HexOfBytes(encoder.encode(input));
-}
-
-// ../core/src/version-transport.ts
-function isContentVersion(value) {
-  return typeof value === "string" && /^sha256:[0-9a-f]{64}$/.test(value);
-}
-var VersionConflict = class extends Error {
-  name = "VersionConflict";
-  id;
-  expected;
-  actual;
-  constructor(id, expected, actual) {
-    super(
-      `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
-    );
-    this.id = id;
-    this.expected = expected;
-    this.actual = actual;
-  }
-};
-
 // ../core/src/versioning.ts
 function sha256Hex(input) {
   return sha256HexOfUtf8(input);
@@ -4924,6 +5117,66 @@ function reservedPath(dir, name) {
 var FilesystemBackend = class _FilesystemBackend {
   #root;
   #port;
+  #coordinator;
+  /** The coordinator is private: no transaction callback or held-root capability escapes. */
+  #withRootMutation(body) {
+    return this.#coordinator.run(body);
+  }
+  #mutateExact(rel, body) {
+    return this.#withRootMutation(() => mutateExact(this.#port, this.#root, rel, body));
+  }
+  #assertInventoryGuard() {
+    if (Object.getPrototypeOf(this) !== _FilesystemBackend.prototype || ["read", "readMany", "list", "write", "delete", "writeReserved", "writeBlob", "deleteBlob", "readReserved"].some((name) => this[name] !== _FilesystemBackend.prototype[name])) {
+      throw new InventoryGuardUnsupported("unqualified_filesystem_override");
+    }
+  }
+  get inventoryGuard() {
+    this.#assertInventoryGuard();
+    return bindInventoryGuard(this, {
+      observeTarget: () => this.#withRootMutation(() => {
+        this.#assertInventoryGuard();
+        return this.#guardTarget();
+      }),
+      compareInventoryAndWrite: async (input) => {
+        const request = captureInventoryGuardRequest(input);
+        const raw = stringifyDoc(request.doc.frontmatter, request.doc.body);
+        return this.#withRootMutation(async () => {
+          this.#assertInventoryGuard();
+          const target = await this.#guardTarget();
+          const inventory = [];
+          const ids = await this.list();
+          assertInventoryGuardBound(ids.length);
+          const deadline = performance.now() + 5e3;
+          for (const id of ids) {
+            if (performance.now() > deadline) throw new InventoryGuardUnsupported("inventory_scan_time_bound");
+            const raw2 = await readRawFilesystemDocument(this, id);
+            parseMarkdown(new TextDecoder("utf-8", { fatal: true }).decode(raw2.bytes), pathFromConceptId(id), { okfVersion: target.edition });
+            inventory.push({ id, version: raw2.version });
+          }
+          if (performance.now() > deadline) throw new InventoryGuardUnsupported("inventory_scan_time_bound");
+          compareInventoryPremises(request, target, inventory);
+          const version2 = await mutateExact(this.#port, this.#root, pathFromConceptId(request.id), async (leaf) => {
+            compareInventoryPremises(request, await this.#guardTarget(), inventory);
+            const bytes = await leaf.current();
+            if (bytes === null || versionOfBytes(bytes.toString("utf8")) !== request.expectedVersion) throw new InventoryGuardConflict("target_version");
+            await leaf.replace(Buffer.from(raw, "utf8"));
+            return versionOfBytes(raw);
+          });
+          return { version: version2, target, inventory_digest: inventoryDigest(inventory) };
+        });
+      }
+    });
+  }
+  async #guardTarget() {
+    const witness = await filesystemRootWitness(this.#port, this.#root);
+    const metadata = await readRawFilesystemReserved(this, "", "index.md");
+    const content = metadata === null ? null : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(metadata.bytes);
+    const edition = guardEdition(content);
+    const after = await filesystemRootWitness(this.#port, this.#root);
+    if (witness !== after) throw new InventoryGuardConflict("identity");
+    const store = versionOfBytes(`${await filesystemRootMutationKey(this.#root)}:${this.#coordinator.namespace()}:${witness}`);
+    return { contract: "inventory-guard/v1", domain: INVENTORY_GUARD_DOMAIN, adapter: "filesystem", store, edition, root_version: blobVersion(metadata.bytes) };
+  }
   /**
    * The root is resolved once here: a relative root would otherwise re-resolve against the
    * process's current directory on every operation, so a later `chdir` would silently move the
@@ -4932,6 +5185,7 @@ var FilesystemBackend = class _FilesystemBackend {
   constructor(root, options = {}) {
     this.#port = createNodeFilesystemIdentityPort(options.hostPolicy);
     this.#root = path3.resolve(root);
+    this.#coordinator = createFilesystemMutationCoordinator(this.#port, this.#root, options.hostPolicy);
     publicationContexts.set(this, { root: this.#root, port: this.#port });
   }
   async read(id) {
@@ -4976,7 +5230,7 @@ var FilesystemBackend = class _FilesystemBackend {
     assertSafeConceptId(id);
     const raw = stringifyDoc(doc.frontmatter, doc.body ?? "");
     const rel = pathFromConceptId(id);
-    return mutateExact(this.#port, this.#root, rel, async (target) => {
+    return this.#mutateExact(rel, async (target) => {
       if (options.expectedVersion !== void 0) {
         const bytes = await target.current();
         const current = bytes === null ? null : versionOfBytes(bytes.toString("utf8"));
@@ -4990,7 +5244,7 @@ var FilesystemBackend = class _FilesystemBackend {
   }
   async delete(id, options = {}) {
     assertSafeConceptId(id);
-    return mutateExact(this.#port, this.#root, pathFromConceptId(id), async (target) => {
+    return this.#mutateExact(pathFromConceptId(id), async (target) => {
       const bytes = await target.current();
       if (bytes === null) return false;
       const current = versionOfBytes(bytes.toString("utf8"));
@@ -5054,7 +5308,7 @@ var FilesystemBackend = class _FilesystemBackend {
     assertSafeReservedDir(dir);
     assertSafeReservedFilename(name);
     const rel = reservedPath(dir, name);
-    return mutateExact(this.#port, this.#root, rel, async (target) => {
+    return this.#mutateExact(rel, async (target) => {
       if (options.expectedVersion !== void 0) {
         const bytes = await target.current();
         const current = bytes === null ? null : versionOfBytes(bytes.toString("utf8"));
@@ -5076,7 +5330,7 @@ var FilesystemBackend = class _FilesystemBackend {
   }
   async writeBlob(key, bytes, _contentType, options = {}) {
     assertSafeBlobKey(key);
-    return mutateExact(this.#port, this.#root, key, async (target) => {
+    return this.#mutateExact(key, async (target) => {
       if (options.expectedVersion !== void 0) {
         const existing = await target.current();
         const current = existing === null ? null : blobVersion(existing);
@@ -5090,7 +5344,7 @@ var FilesystemBackend = class _FilesystemBackend {
   }
   async deleteBlob(key, options = {}) {
     assertSafeBlobKey(key);
-    return mutateExact(this.#port, this.#root, key, async (target) => {
+    return this.#mutateExact(key, async (target) => {
       const existing = await target.current();
       if (existing === null) return false;
       const current = blobVersion(existing);
@@ -5108,8 +5362,8 @@ var FilesystemBackend = class _FilesystemBackend {
   }
   async listBlobs(prefix) {
     const files = await walkFiles(this.#port, this.#root, (name) => !name.toLowerCase().endsWith(".md"));
-    const keys = files.map(toPosix);
-    const filtered = prefix ? keys.filter((k) => k.startsWith(prefix)) : keys;
+    const keys2 = files.map(toPosix);
+    const filtered = prefix ? keys2.filter((k) => k.startsWith(prefix)) : keys2;
     filtered.sort(compareStorageKeys);
     return filtered;
   }
@@ -5123,6 +5377,35 @@ var FilesystemBackend = class _FilesystemBackend {
     };
   }
 };
+function publicationContext(backend) {
+  const context = publicationContexts.get(backend);
+  if (!context) throw new InvalidInputError("Unknown filesystem backend publication source.");
+  return context;
+}
+async function readRawFilesystemDocument(backend, id) {
+  return readRawDocumentIn(backend, id);
+}
+async function readRawDocumentIn(backend, id, pass) {
+  assertSafeConceptId(id);
+  const { root, port } = publicationContext(backend);
+  const rel = pathFromConceptId(id);
+  const read = (handle) => readBytes(port, handle);
+  const observed = pass ? await pass.observe(rel, read) : await observeExact(port, root, rel, read);
+  if (observed.state === "absent") throw notFound(root, rel);
+  const raw = new TextDecoder("utf-8", { fatal: true }).decode(observed.value);
+  return { bytes: observed.value.slice(), version: versionOfBytes(raw) };
+}
+async function readRawFilesystemReserved(backend, dir, name) {
+  assertSafeReservedDir(dir);
+  assertSafeReservedFilename(name);
+  const { root, port } = publicationContext(backend);
+  const observed = await observeExact(port, root, reservedPath(dir, name), (handle) => readBytes(port, handle));
+  if (observed.state === "absent") return null;
+  return {
+    bytes: observed.value.slice(),
+    version: versionOfBytes(observed.value.toString("utf8"))
+  };
+}
 
 // ../core/src/bundle-ops.ts
 var defaultBackendFactory;
@@ -5157,6 +5440,86 @@ async function queryEdges2(bundle, filter = {}, options = {}) {
 // ../core/src/bundle.ts
 setDefaultBackendFactory((root) => new FilesystemBackend(root));
 
+// ../core/src/managed-document-metadata.ts
+var MANAGED_DOCUMENT_METADATA_FIELDS = /* @__PURE__ */ new Set([
+  "generated",
+  "verified",
+  "superbee_updated_by",
+  "actor",
+  "timestamp"
+]);
+function isManagedDocumentMetadataField(field) {
+  return MANAGED_DOCUMENT_METADATA_FIELDS.has(field);
+}
+
+// ../core/src/kind-deprecation.ts
+var problem = (field, message) => ({
+  code: "KIND_DEPRECATION_INVALID",
+  field,
+  message: `${field}: ${message}`,
+  severity: "warning"
+});
+function parseKindDeprecation(raw, kind, reserved, claimFields) {
+  const result = { fields: [], values: {}, links: [] };
+  const problems = [];
+  const fail2 = (field, message) => {
+    problems.push(problem(field, message));
+  };
+  const names = (value, path4) => {
+    if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || !v.trim() || v !== v.trim())) {
+      fail2(path4, "expected a list of nonempty exact names");
+      return [];
+    }
+    return [...new Set(value)];
+  };
+  const protectedField = (field) => reserved.includes(field) || isOkfStandardField(field) || isManagedDocumentMetadataField(field) || claimFields.includes(field);
+  if (!isOkfRecord(raw)) fail2("deprecated", "expected a map of fields, values and links");
+  else {
+    for (const key of Object.keys(raw)) if (!["fields", "values", "links"].includes(key)) fail2(`deprecated.${key}`, "unknown policy coordinate");
+    if (Object.hasOwn(raw, "fields")) result.fields = names(raw.fields, "deprecated.fields");
+    for (const field of result.fields) {
+      if (!kind.fields.optional.includes(field) || kind.fields.required.includes(field) || protectedField(field)) {
+        fail2(`deprecated.fields.${field}`, "only an optional, nonstandard, nonreserved, nonclaim field can be deprecated");
+      }
+    }
+    if (Object.hasOwn(raw, "values")) {
+      if (!isOkfRecord(raw.values)) fail2("deprecated.values", "expected a field-to-values map");
+      else for (const [field, value] of Object.entries(raw.values)) {
+        const path4 = `deprecated.values.${field}`;
+        const values = Array.isArray(value) && value.every((v) => ["string", "number", "boolean"].includes(typeof v)) ? [...new Set(value.map(String))] : void 0;
+        if (!values || values.some((v) => !v.trim())) {
+          fail2(path4, "expected a list of enum members");
+          continue;
+        }
+        Object.defineProperty(result.values, field, { value: values, enumerable: true, writable: true, configurable: true });
+        const allowed = Object.hasOwn(kind.fields.values, field) ? kind.fields.values[field] : void 0;
+        if (protectedField(field) || ![...kind.fields.required, ...kind.fields.optional].includes(field) || !allowed || values.some((v) => !allowed.includes(v)) || kind.fields.types?.[field] === "https-url-list") {
+          fail2(path4, "expected members of a declared, nonstandard, nonclaim vocabulary");
+        }
+        const terminal = Object.hasOwn(kind.fields.terminal, field) ? kind.fields.terminal[field] : [];
+        if (values.some((v) => terminal.includes(v))) fail2(path4, "terminal members require a separate migration");
+        if (kind.fields.required.includes(field) && allowed && !allowed.some((v) => !values.includes(v))) fail2(path4, "a required field must retain an active member");
+      }
+    }
+    if (Object.hasOwn(raw, "links")) result.links = names(raw.links, "deprecated.links");
+    for (const label of result.links) if (!kind.links || !Object.hasOwn(kind.links, label)) fail2(`deprecated.links.${label}`, "expected an existing outbound label");
+  }
+  if (problems.length) {
+    result.problems = problems;
+    result.raw = structuredClone(raw);
+  }
+  return result;
+}
+function kindDeprecationProblems(kind, registry) {
+  const problems = [...kind.deprecated?.problems ?? []];
+  for (const label of kind.deprecated?.links ?? []) {
+    if ([...registry?.kinds.values() ?? [kind]].some((k) => k.expectsInbound && Object.hasOwn(k.expectsInbound, label))) {
+      problems.push(problem(`deprecated.links.${label}`, "the admitted registry still declares an inbound expectation for this label"));
+    }
+  }
+  return problems;
+}
+
 // ../core/src/kinds.ts
 var CONVENTIONS_PREFIX = "conventions/";
 var CONVENTION_TYPE = "Convention";
@@ -5220,6 +5583,7 @@ function buildKindRegistry(docs, initialWarnings = [], options = {}) {
     }
     accepted.set(kind.governs, kind);
   }
+  for (const kind of accepted.values()) warnings.push(...kindDeprecationProblems(kind, { kinds: accepted, warnings: [] }).filter((w) => !warnings.includes(w)));
   const kinds = /* @__PURE__ */ new Map();
   for (const kind of [...accepted.values()].sort(compareReadingOrder)) kinds.set(kind.governs, kind);
   return { kinds, warnings };
@@ -5233,9 +5597,9 @@ function compareReadingOrder(a, b) {
 var PROGRESS_STATUS_FIELD = "progress_status";
 var SUPERBEE_PROGRESS_STATUS_FIELD = "superbee_progress_status";
 function progressStatusStorageField(okfVersion) {
-  const version = okfVersion?.trim() || "0.1";
-  if (version === "0.1") return "status";
-  if (version === "0.2") return SUPERBEE_PROGRESS_STATUS_FIELD;
+  const version2 = okfVersion?.trim() || "0.1";
+  if (version2 === "0.1") return "status";
+  if (version2 === "0.2") return SUPERBEE_PROGRESS_STATUS_FIELD;
   return void 0;
 }
 function declaresField(kind, field) {
@@ -5258,6 +5622,19 @@ function resolveKindFieldCoordinate(okfVersion, kind, field) {
   if (field === PROGRESS_STATUS_FIELD && progress) return progress;
   return void 0;
 }
+function claimCoordinates(okfVersion, kind) {
+  if (!kind.claim) return void 0;
+  const resolve = (field) => field === void 0 ? void 0 : resolveKindFieldCoordinate(okfVersion, kind, field)?.storageField;
+  const ownerField = resolve(kind.claim.ownerField);
+  const stateField = resolve(kind.claim.stateField);
+  const fields = [...new Set([ownerField, stateField].filter((f) => f !== void 0))];
+  if (fields.length === 0) return void 0;
+  return {
+    ...ownerField !== void 0 ? { ownerField } : {},
+    ...stateField !== void 0 ? { stateField } : {},
+    fields
+  };
+}
 function readKindField(okfVersion, kind, frontmatter2, field) {
   const coordinate = resolveKindFieldCoordinate(okfVersion, kind, field);
   return coordinate ? frontmatter2[coordinate.storageField] : void 0;
@@ -5278,11 +5655,11 @@ function isPlainObject(value) {
   const prototype = Object.getPrototypeOf(value);
   return prototype === Object.prototype || prototype === null;
 }
-function hasOwn(record, key) {
-  return Object.prototype.hasOwnProperty.call(record, key);
+function hasOwn(record2, key) {
+  return Object.prototype.hasOwnProperty.call(record2, key);
 }
-function setOwn(record, key, value) {
-  Object.defineProperty(record, key, { value, enumerable: true, configurable: true, writable: true });
+function setOwn(record2, key, value) {
+  Object.defineProperty(record2, key, { value, enumerable: true, configurable: true, writable: true });
 }
 function isScalar(value) {
   return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
@@ -5774,6 +6151,10 @@ function parseConventionDoc(doc, options = {}) {
   if (browseCollapsed !== void 0) kind.browseCollapsed = browseCollapsed;
   if (order !== void 0) kind.order = order;
   if (claim !== void 0) kind.claim = claim;
+  if (Object.hasOwn(fm, "deprecated")) {
+    kind.deprecated = parseKindDeprecation(fm.deprecated, kind, RESERVED_KIND_FIELD_NAMES, claimCoordinates(options.okfVersion, kind)?.fields ?? []);
+    warnings.push(...kind.deprecated.problems ?? []);
+  }
   return {
     ok: true,
     kind,
@@ -6303,8 +6684,8 @@ var BridgeService = class {
     if (!after) return this.reload(launchId, "the View changed while its subscription was polled");
     const changes = [];
     const removed = [];
-    for (const [id, version] of next) {
-      if (subscription.baseline.get(id) !== version) changes.push({ id, version });
+    for (const [id, version2] of next) {
+      if (subscription.baseline.get(id) !== version2) changes.push({ id, version: version2 });
     }
     for (const id of subscription.baseline.keys()) {
       if (!next.has(id)) removed.push(id);