@equationalapplications/core-llm-wiki 7.1.2 → 7.2.0

package/dist/{testing-CA7723qk.d.mts → testing-DYeMd9d1.d.mts}

@@ -8,6 +8,18 @@ import { SearchResult } from 'minisearch';
  */
 interface SQLiteAdapter {
     execAsync(sql: string): Promise<void>;
+    /**
+     * `changes` must report the number of rows the statement actually wrote.
+     * It must be 0 when a conflict clause suppresses a write (INSERT OR IGNORE,
+     * or ON CONFLICT DO UPDATE ... WHERE), and must never be nonzero for a
+     * suppressed write. A permitted write that modifies no column value still
+     * counts the row, as SQLite does.
+     *
+     * This count is load-bearing beyond ownership checks: edge insertion
+     * (and therefore upsertGraph's public edgesWritten), metadata compare-and-set,
+     * soft-delete success reporting, and maintenance sweep counts all read it.
+     * An adapter that under-reports silently corrupts those results.
+     */
     runAsync(sql: string, params?: unknown[]): Promise<{
         changes: number;
         lastInsertRowId: number;
@@ -740,6 +752,33 @@ declare class WikiSourceRefHashCollision extends Error {
         attemptedSourceRef: string;
     });
 }
+/**
+ * Thrown when a graph node ID is already owned by another entity.
+ *
+ * Raised by `WikiMemory.upsertGraph`'s node-ownership pre-flight and,
+ * independently, by `EntryRepository.upsert` for every caller — which is why
+ * `ingestDocument` can surface it too (it shares `upsertGraphCore` on its full
+ * path and `EntryRepository.upsert` on its partial path).
+ *
+ * Deliberately carries NO context: no owner entity, node ID, stored content,
+ * provenance, or `cause`. A rejection is reachable by whatever supplies the
+ * node IDs, so the error must not become a channel for reading another
+ * entity's identifiers. The `WIKI_`-prefixed code and fixed message also keep
+ * it clear of `extractSqliteCode`, so it passes through the serialized
+ * transaction wrapper unwrapped.
+ */
+declare class WikiGraphNodeOwnershipConflict extends Error {
+    readonly code: "WIKI_GRAPH_NODE_OWNERSHIP_CONFLICT";
+    /**
+     * Privacy-preserving constructor: accepts no arguments, so neither the foreign
+     * owner, the conflicting node ID, the stored content, nor any provenance can
+     * leak through this error. The fixed message and `code` are the entire signal.
+     *
+     * @returns a contextless `WikiGraphNodeOwnershipConflict` instance. See the
+     *   class-level JSDoc for the privacy rationale.
+     */
+    constructor();
+}
 /**
  * Thrown by the serialized transaction wrapper when a SQLite driver error
  * escapes a transaction callback (nested BEGIN, SQLITE_BUSY, constraint
@@ -965,6 +1004,26 @@ declare class EntryRepository extends BaseRepository {
      * diagnostic that inflates runReembed's permanentlyFailed counter. A conflict
      * with no blob leaves marker state alone, matching the "absent means don't
      * touch" semantics used for embedding_blob itself.
+     *
+     * Graph node ownership (spec §2.4 + §3, REQ-OWN-01 + REQ-GRAPH-01): entry
+     * IDs share one database-wide namespace, so an ID stays owned by its
+     * existing entity for as long as the row exists — soft deletion included.
+     * The pre-write lookup already reads the existing row for OKF metadata; we
+     * project `entity_id` off that same SELECT and reject the write before
+     * any outbox payload construction when the stored owner differs from
+     * `fact.entity_id`. Soft-deleted foreign rows keep their IDs reserved;
+     * permanent reservation is NOT introduced, so a physically absent ID may
+     * still be inserted under the requested entity. The ON CONFLICT UPDATE SET
+     * clause carries a final `WHERE entries.entity_id = excluded.entity_id`
+     * guard so the database itself refuses a cross-owner row overwrite even if
+     * a future caller bypasses the pre-write check. When `runAsync` reports
+     * 0 changes (a legitimate conflict-suppressed write, OR an adapter that
+     * under-reports a permitted write) we re-read the stored owner; only a
+     * foreign owner throws — this is local defensive behavior, not permission
+     * for adapters to under-report. The thrown error is
+     * `WikiGraphNodeOwnershipConflict` (no owner, node ID, or stored content
+     * is disclosed). Upserts that pass both gates retain existing same-entity
+     * update + resurrection semantics.
      */
     upsert(fact: WikiFact, tx: SQLiteAdapter): Promise<{
         changes: number;
@@ -1814,6 +1873,28 @@ declare class IngestionService {
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
     }): Promise<IngestDocumentResult>;
+    /**
+     * Reject the whole write when any incoming node ID is already owned by a
+     * different entity. Runs entirely inside the supplied `tx`, through the
+     * repository abstraction, and — being the first thing `upsertGraphCore`
+     * does — before ontology resolution, which can itself persist a configured
+     * seed manifest.
+     *
+     * The lookup has no deleted-row filter, so a soft-deleted foreign row keeps
+     * its ID reserved. Only the lookup IDs are deduplicated; `params.nodes` and
+     * the later write loops keep their ordering and counts.
+     *
+     * The error is deliberately contextless — see WikiGraphNodeOwnershipConflict.
+     *
+     * @param entityId - the entity the caller is writing on behalf of. Foreign
+     *   rows under a different entity trigger the rejection.
+     * @param nodes - incoming node set; only the IDs are inspected, so callers
+     *   may pass the public `params.nodes` shape directly without slicing.
+     * @param tx - the open transaction. Reuses the same handle every later
+     *   statement in `upsertGraphCore` runs against, so atomicity is enforced
+     *   by the host transaction's commit/rollback, not by this method.
+     */
+    private assertGraphNodeOwnership;
     /**
      * Implements spec §2 data flow steps a–j with the host-facing
      * `{sourceRef, sourceHash, nodes, edges}` parameter shape. Shared between
@@ -1832,6 +1913,16 @@ declare class IngestionService {
      * @returns Counts: nodesWritten (validated nodes persisted), edgesWritten
      *   (manifest-valid edges persisted), superseded (prior facts soft-deleted
      *   plus prior source-ref edges hard-deleted).
+     *
+     * Node-ownership pre-flight (spec §3, REQ-GRAPH-01): the first statement
+     * is `assertGraphNodeOwnership(entityId, params.nodes, tx)`, which runs
+     * before ontology resolution, seed-manifest persistence, and every other
+     * write. A foreign-owned ID throws `WikiGraphNodeOwnershipConflict` with
+     * no disclosed owner, node ID, or content; the caller's transaction
+     * remains open and must be rolled back by the host. Soft-deleted foreign
+     * rows keep their IDs reserved. Duplicate incoming IDs are deduplicated
+     * only for the lookup; `params.nodes` and the write loops keep their
+     * ordering and counts so success counts match the pre-change contract.
      */
     upsertGraphCore(entityId: string, params: {
         sourceRef: string;
@@ -2451,6 +2542,11 @@ declare class WikiMemory {
         metadataReset?: boolean;
     }>;
     /**
+     * Full and partial ingestion both reject foreign-owned generated fact IDs with
+     * `WikiGraphNodeOwnershipConflict`. Such collisions are unexpected. Ingestion
+     * may already have persisted ontology or other state before rejection; unlike
+     * direct graph preflight, it relies on transaction rollback for atomicity.
+     *
      * @param params.promptOverride - Overrides the system prompt for this ingest call only.
      * For persistent customization, set `options.config.prompts.ingestSystemPrompt` at
      * WikiMemory construction time.
@@ -2490,6 +2586,19 @@ declare class WikiMemory {
      *   or edge `type` throws `WikiStrictOntologyViolation` (pre-flight,
      *   all-or-nothing — NONE written on failure).
      *
+     * Entry IDs share one database-wide namespace. Existing rows, including
+     * soft-deleted rows, reserve their IDs for their entity; same-entity updates
+     * and resurrection remain supported. Hosts authenticate callers and select
+     * the authorized entity ID; entity-qualified IDs are optional, not required.
+     * After the live-only C2 probe above, a foreign node ID throws the fixed,
+     * privacy-preserving `WikiGraphNodeOwnershipConflict` before persistent writes
+     * (including seed manifests). Deleted source mappings do not trigger C2.
+     *
+     * Propagate later failures to roll back the host transaction. In particular,
+     * foreign edge-ID collisions remain late bare `Error`s: the foreign edge is
+     * not overwritten, but catching and committing can retain earlier writes.
+     * This method neither commits nor rolls back the caller's transaction.
+     *
      * @returns Counts: nodesWritten (validated nodes persisted), edgesWritten
      *   (manifest-valid edges persisted), superseded (prior facts soft-deleted
      *   plus prior source-ref edges hard-deleted).
@@ -2604,4 +2713,4 @@ declare class WikiMemory {
     setGeneratedByTask(taskId: string, entityId: string, actor: string): Promise<void>;
 }
 
-export { WikiIngestEmptyError as $, type ReembedResult as A, type VectorRankerFallback as B, type ChunkFailure as C, type DegradedRecord as D, type EmbedFactResult as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type VectorRankerRankArgs as J, type VectorRankerSemanticResult as K, type LLMProvider as L, type MemoryBundle as M, WikiBusyError as N, type OntologyManifest as O, type PromptOverrides as P, type WikiBusyOperation as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiCheckpoint as T, type WikiConfig as U, type VectorRanker as V, type WikiOptions as W, WikiDuplicateHashError as X, type WikiEdge as Y, type WikiEvent as Z, type WikiFact as _, type MemoryDump as a, WikiInvalidReadOptions as a0, type WikiMemoryTestAccess as a1, type WikiOutboxEvent as a2, WikiParseError as a3, WikiSourceRefHashCollision as a4, WikiStrictOntologyViolation as a5, type WikiTask as a6, WikiTransactionError as a7, EmbeddingService as a8, ImportExportService as a9, IngestionService as aa, JobManager as ab, MaintenanceService as ac, RetrievalService as ad, SearchService as ae, WriteService as af, type FormattedMemoryDump as b, WikiMemory as c, type EmbedFailureKind as d, type EmbeddingMarkerKind as e, type EntityStatus as f, type ExtractedFact as g, type ExtractedFactEdge as h, type ExtractedFactWithOntology as i, type ExtractedTask as j, type GraphTraversalOptions as k, HEAL_RECHECK_MS as l, HOOK_TIMEOUT_MARKER as m, type HealResult as n, ONTOLOGY_BACKFILL_BATCH_SIZE as o, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as p, ONTOLOGY_BACKFILL_RECHECK_MS as q, type OntologyBackfillResult as r, type OntologyConfig as s, type OntologyEdgeType as t, type OntologyMode as u, type OntologyNodeType as v, type OntologyPromptContext as w, type OntologyUpdates as x, PromptService as y, PrunePartialFailureError as z };
+export { WikiGraphNodeOwnershipConflict as $, type ReembedResult as A, type VectorRankerFallback as B, type ChunkFailure as C, type DegradedRecord as D, type EmbedFactResult as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type VectorRankerRankArgs as J, type VectorRankerSemanticResult as K, type LLMProvider as L, type MemoryBundle as M, WikiBusyError as N, type OntologyManifest as O, type PromptOverrides as P, type WikiBusyOperation as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiCheckpoint as T, type WikiConfig as U, type VectorRanker as V, type WikiOptions as W, WikiDuplicateHashError as X, type WikiEdge as Y, type WikiEvent as Z, type WikiFact as _, type MemoryDump as a, WikiIngestEmptyError as a0, WikiInvalidReadOptions as a1, type WikiMemoryTestAccess as a2, type WikiOutboxEvent as a3, WikiParseError as a4, WikiSourceRefHashCollision as a5, WikiStrictOntologyViolation as a6, type WikiTask as a7, WikiTransactionError as a8, EmbeddingService as a9, ImportExportService as aa, IngestionService as ab, JobManager as ac, MaintenanceService as ad, RetrievalService as ae, SearchService as af, WriteService as ag, type FormattedMemoryDump as b, WikiMemory as c, type EmbedFailureKind as d, type EmbeddingMarkerKind as e, type EntityStatus as f, type ExtractedFact as g, type ExtractedFactEdge as h, type ExtractedFactWithOntology as i, type ExtractedTask as j, type GraphTraversalOptions as k, HEAL_RECHECK_MS as l, HOOK_TIMEOUT_MARKER as m, type HealResult as n, ONTOLOGY_BACKFILL_BATCH_SIZE as o, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as p, ONTOLOGY_BACKFILL_RECHECK_MS as q, type OntologyBackfillResult as r, type OntologyConfig as s, type OntologyEdgeType as t, type OntologyMode as u, type OntologyNodeType as v, type OntologyPromptContext as w, type OntologyUpdates as x, PromptService as y, PrunePartialFailureError as z };

package/dist/{testing-CA7723qk.d.ts → testing-DYeMd9d1.d.ts}

@@ -8,6 +8,18 @@ import { SearchResult } from 'minisearch';
  */
 interface SQLiteAdapter {
     execAsync(sql: string): Promise<void>;
+    /**
+     * `changes` must report the number of rows the statement actually wrote.
+     * It must be 0 when a conflict clause suppresses a write (INSERT OR IGNORE,
+     * or ON CONFLICT DO UPDATE ... WHERE), and must never be nonzero for a
+     * suppressed write. A permitted write that modifies no column value still
+     * counts the row, as SQLite does.
+     *
+     * This count is load-bearing beyond ownership checks: edge insertion
+     * (and therefore upsertGraph's public edgesWritten), metadata compare-and-set,
+     * soft-delete success reporting, and maintenance sweep counts all read it.
+     * An adapter that under-reports silently corrupts those results.
+     */
     runAsync(sql: string, params?: unknown[]): Promise<{
         changes: number;
         lastInsertRowId: number;
@@ -740,6 +752,33 @@ declare class WikiSourceRefHashCollision extends Error {
         attemptedSourceRef: string;
     });
 }
+/**
+ * Thrown when a graph node ID is already owned by another entity.
+ *
+ * Raised by `WikiMemory.upsertGraph`'s node-ownership pre-flight and,
+ * independently, by `EntryRepository.upsert` for every caller — which is why
+ * `ingestDocument` can surface it too (it shares `upsertGraphCore` on its full
+ * path and `EntryRepository.upsert` on its partial path).
+ *
+ * Deliberately carries NO context: no owner entity, node ID, stored content,
+ * provenance, or `cause`. A rejection is reachable by whatever supplies the
+ * node IDs, so the error must not become a channel for reading another
+ * entity's identifiers. The `WIKI_`-prefixed code and fixed message also keep
+ * it clear of `extractSqliteCode`, so it passes through the serialized
+ * transaction wrapper unwrapped.
+ */
+declare class WikiGraphNodeOwnershipConflict extends Error {
+    readonly code: "WIKI_GRAPH_NODE_OWNERSHIP_CONFLICT";
+    /**
+     * Privacy-preserving constructor: accepts no arguments, so neither the foreign
+     * owner, the conflicting node ID, the stored content, nor any provenance can
+     * leak through this error. The fixed message and `code` are the entire signal.
+     *
+     * @returns a contextless `WikiGraphNodeOwnershipConflict` instance. See the
+     *   class-level JSDoc for the privacy rationale.
+     */
+    constructor();
+}
 /**
  * Thrown by the serialized transaction wrapper when a SQLite driver error
  * escapes a transaction callback (nested BEGIN, SQLITE_BUSY, constraint
@@ -965,6 +1004,26 @@ declare class EntryRepository extends BaseRepository {
      * diagnostic that inflates runReembed's permanentlyFailed counter. A conflict
      * with no blob leaves marker state alone, matching the "absent means don't
      * touch" semantics used for embedding_blob itself.
+     *
+     * Graph node ownership (spec §2.4 + §3, REQ-OWN-01 + REQ-GRAPH-01): entry
+     * IDs share one database-wide namespace, so an ID stays owned by its
+     * existing entity for as long as the row exists — soft deletion included.
+     * The pre-write lookup already reads the existing row for OKF metadata; we
+     * project `entity_id` off that same SELECT and reject the write before
+     * any outbox payload construction when the stored owner differs from
+     * `fact.entity_id`. Soft-deleted foreign rows keep their IDs reserved;
+     * permanent reservation is NOT introduced, so a physically absent ID may
+     * still be inserted under the requested entity. The ON CONFLICT UPDATE SET
+     * clause carries a final `WHERE entries.entity_id = excluded.entity_id`
+     * guard so the database itself refuses a cross-owner row overwrite even if
+     * a future caller bypasses the pre-write check. When `runAsync` reports
+     * 0 changes (a legitimate conflict-suppressed write, OR an adapter that
+     * under-reports a permitted write) we re-read the stored owner; only a
+     * foreign owner throws — this is local defensive behavior, not permission
+     * for adapters to under-report. The thrown error is
+     * `WikiGraphNodeOwnershipConflict` (no owner, node ID, or stored content
+     * is disclosed). Upserts that pass both gates retain existing same-entity
+     * update + resurrection semantics.
      */
     upsert(fact: WikiFact, tx: SQLiteAdapter): Promise<{
         changes: number;
@@ -1814,6 +1873,28 @@ declare class IngestionService {
     }, opts?: {
         onDuplicateHash?: 'ingest' | 'skip' | 'throw';
     }): Promise<IngestDocumentResult>;
+    /**
+     * Reject the whole write when any incoming node ID is already owned by a
+     * different entity. Runs entirely inside the supplied `tx`, through the
+     * repository abstraction, and — being the first thing `upsertGraphCore`
+     * does — before ontology resolution, which can itself persist a configured
+     * seed manifest.
+     *
+     * The lookup has no deleted-row filter, so a soft-deleted foreign row keeps
+     * its ID reserved. Only the lookup IDs are deduplicated; `params.nodes` and
+     * the later write loops keep their ordering and counts.
+     *
+     * The error is deliberately contextless — see WikiGraphNodeOwnershipConflict.
+     *
+     * @param entityId - the entity the caller is writing on behalf of. Foreign
+     *   rows under a different entity trigger the rejection.
+     * @param nodes - incoming node set; only the IDs are inspected, so callers
+     *   may pass the public `params.nodes` shape directly without slicing.
+     * @param tx - the open transaction. Reuses the same handle every later
+     *   statement in `upsertGraphCore` runs against, so atomicity is enforced
+     *   by the host transaction's commit/rollback, not by this method.
+     */
+    private assertGraphNodeOwnership;
     /**
      * Implements spec §2 data flow steps a–j with the host-facing
      * `{sourceRef, sourceHash, nodes, edges}` parameter shape. Shared between
@@ -1832,6 +1913,16 @@ declare class IngestionService {
      * @returns Counts: nodesWritten (validated nodes persisted), edgesWritten
      *   (manifest-valid edges persisted), superseded (prior facts soft-deleted
      *   plus prior source-ref edges hard-deleted).
+     *
+     * Node-ownership pre-flight (spec §3, REQ-GRAPH-01): the first statement
+     * is `assertGraphNodeOwnership(entityId, params.nodes, tx)`, which runs
+     * before ontology resolution, seed-manifest persistence, and every other
+     * write. A foreign-owned ID throws `WikiGraphNodeOwnershipConflict` with
+     * no disclosed owner, node ID, or content; the caller's transaction
+     * remains open and must be rolled back by the host. Soft-deleted foreign
+     * rows keep their IDs reserved. Duplicate incoming IDs are deduplicated
+     * only for the lookup; `params.nodes` and the write loops keep their
+     * ordering and counts so success counts match the pre-change contract.
      */
     upsertGraphCore(entityId: string, params: {
         sourceRef: string;
@@ -2451,6 +2542,11 @@ declare class WikiMemory {
         metadataReset?: boolean;
     }>;
     /**
+     * Full and partial ingestion both reject foreign-owned generated fact IDs with
+     * `WikiGraphNodeOwnershipConflict`. Such collisions are unexpected. Ingestion
+     * may already have persisted ontology or other state before rejection; unlike
+     * direct graph preflight, it relies on transaction rollback for atomicity.
+     *
      * @param params.promptOverride - Overrides the system prompt for this ingest call only.
      * For persistent customization, set `options.config.prompts.ingestSystemPrompt` at
      * WikiMemory construction time.
@@ -2490,6 +2586,19 @@ declare class WikiMemory {
      *   or edge `type` throws `WikiStrictOntologyViolation` (pre-flight,
      *   all-or-nothing — NONE written on failure).
      *
+     * Entry IDs share one database-wide namespace. Existing rows, including
+     * soft-deleted rows, reserve their IDs for their entity; same-entity updates
+     * and resurrection remain supported. Hosts authenticate callers and select
+     * the authorized entity ID; entity-qualified IDs are optional, not required.
+     * After the live-only C2 probe above, a foreign node ID throws the fixed,
+     * privacy-preserving `WikiGraphNodeOwnershipConflict` before persistent writes
+     * (including seed manifests). Deleted source mappings do not trigger C2.
+     *
+     * Propagate later failures to roll back the host transaction. In particular,
+     * foreign edge-ID collisions remain late bare `Error`s: the foreign edge is
+     * not overwritten, but catching and committing can retain earlier writes.
+     * This method neither commits nor rolls back the caller's transaction.
+     *
      * @returns Counts: nodesWritten (validated nodes persisted), edgesWritten
      *   (manifest-valid edges persisted), superseded (prior facts soft-deleted
      *   plus prior source-ref edges hard-deleted).
@@ -2604,4 +2713,4 @@ declare class WikiMemory {
     setGeneratedByTask(taskId: string, entityId: string, actor: string): Promise<void>;
 }
 
-export { WikiIngestEmptyError as $, type ReembedResult as A, type VectorRankerFallback as B, type ChunkFailure as C, type DegradedRecord as D, type EmbedFactResult as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type VectorRankerRankArgs as J, type VectorRankerSemanticResult as K, type LLMProvider as L, type MemoryBundle as M, WikiBusyError as N, type OntologyManifest as O, type PromptOverrides as P, type WikiBusyOperation as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiCheckpoint as T, type WikiConfig as U, type VectorRanker as V, type WikiOptions as W, WikiDuplicateHashError as X, type WikiEdge as Y, type WikiEvent as Z, type WikiFact as _, type MemoryDump as a, WikiInvalidReadOptions as a0, type WikiMemoryTestAccess as a1, type WikiOutboxEvent as a2, WikiParseError as a3, WikiSourceRefHashCollision as a4, WikiStrictOntologyViolation as a5, type WikiTask as a6, WikiTransactionError as a7, EmbeddingService as a8, ImportExportService as a9, IngestionService as aa, JobManager as ab, MaintenanceService as ac, RetrievalService as ad, SearchService as ae, WriteService as af, type FormattedMemoryDump as b, WikiMemory as c, type EmbedFailureKind as d, type EmbeddingMarkerKind as e, type EntityStatus as f, type ExtractedFact as g, type ExtractedFactEdge as h, type ExtractedFactWithOntology as i, type ExtractedTask as j, type GraphTraversalOptions as k, HEAL_RECHECK_MS as l, HOOK_TIMEOUT_MARKER as m, type HealResult as n, ONTOLOGY_BACKFILL_BATCH_SIZE as o, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as p, ONTOLOGY_BACKFILL_RECHECK_MS as q, type OntologyBackfillResult as r, type OntologyConfig as s, type OntologyEdgeType as t, type OntologyMode as u, type OntologyNodeType as v, type OntologyPromptContext as w, type OntologyUpdates as x, PromptService as y, PrunePartialFailureError as z };
+export { WikiGraphNodeOwnershipConflict as $, type ReembedResult as A, type VectorRankerFallback as B, type ChunkFailure as C, type DegradedRecord as D, type EmbedFactResult as E, type FormatContextOptions as F, type GraphNeighborhood as G, HEAL_BATCH_SIZE as H, type IngestDocumentResult as I, type VectorRankerRankArgs as J, type VectorRankerSemanticResult as K, type LLMProvider as L, type MemoryBundle as M, WikiBusyError as N, type OntologyManifest as O, type PromptOverrides as P, type WikiBusyOperation as Q, type ReadOptions as R, type SQLiteAdapter as S, type WikiCheckpoint as T, type WikiConfig as U, type VectorRanker as V, type WikiOptions as W, WikiDuplicateHashError as X, type WikiEdge as Y, type WikiEvent as Z, type WikiFact as _, type MemoryDump as a, WikiIngestEmptyError as a0, WikiInvalidReadOptions as a1, type WikiMemoryTestAccess as a2, type WikiOutboxEvent as a3, WikiParseError as a4, WikiSourceRefHashCollision as a5, WikiStrictOntologyViolation as a6, type WikiTask as a7, WikiTransactionError as a8, EmbeddingService as a9, ImportExportService as aa, IngestionService as ab, JobManager as ac, MaintenanceService as ad, RetrievalService as ae, SearchService as af, WriteService as ag, type FormattedMemoryDump as b, WikiMemory as c, type EmbedFailureKind as d, type EmbeddingMarkerKind as e, type EntityStatus as f, type ExtractedFact as g, type ExtractedFactEdge as h, type ExtractedFactWithOntology as i, type ExtractedTask as j, type GraphTraversalOptions as k, HEAL_RECHECK_MS as l, HOOK_TIMEOUT_MARKER as m, type HealResult as n, ONTOLOGY_BACKFILL_BATCH_SIZE as o, ONTOLOGY_BACKFILL_MAX_PROMPT_CHARS as p, ONTOLOGY_BACKFILL_RECHECK_MS as q, type OntologyBackfillResult as r, type OntologyConfig as s, type OntologyEdgeType as t, type OntologyMode as u, type OntologyNodeType as v, type OntologyPromptContext as w, type OntologyUpdates as x, PromptService as y, PrunePartialFailureError as z };

package/dist/testing.d.mts

@@ -1,3 +1,3 @@
-export { a8 as EmbeddingService, a9 as ImportExportService, aa as IngestionService, ab as JobManager, ab as JobManagerType, ac as MaintenanceService, ad as RetrievalService, ae as SearchService, ae as SearchServiceType, a1 as WikiMemoryTestAccess, af as WriteService } from './testing-CA7723qk.mjs';
+export { a9 as EmbeddingService, aa as ImportExportService, ab as IngestionService, ac as JobManager, ac as JobManagerType, ad as MaintenanceService, ae as RetrievalService, af as SearchService, af as SearchServiceType, a2 as WikiMemoryTestAccess, ag as WriteService } from './testing-DYeMd9d1.mjs';
 import '@equationalapplications/core-okf';
 import 'minisearch';

package/dist/testing.d.ts

@@ -1,3 +1,3 @@
-export { a8 as EmbeddingService, a9 as ImportExportService, aa as IngestionService, ab as JobManager, ab as JobManagerType, ac as MaintenanceService, ad as RetrievalService, ae as SearchService, ae as SearchServiceType, a1 as WikiMemoryTestAccess, af as WriteService } from './testing-CA7723qk.js';
+export { a9 as EmbeddingService, aa as ImportExportService, ab as IngestionService, ac as JobManager, ac as JobManagerType, ad as MaintenanceService, ae as RetrievalService, af as SearchService, af as SearchServiceType, a2 as WikiMemoryTestAccess, ag as WriteService } from './testing-DYeMd9d1.js';
 import '@equationalapplications/core-okf';
 import 'minisearch';

package/dist/testing.js

@@ -90,6 +90,21 @@ var WikiStrictOntologyViolation = class extends Error {
     this.name = "WikiStrictOntologyViolation";
   }
 };
+var WikiGraphNodeOwnershipConflict = class extends Error {
+  /**
+   * Privacy-preserving constructor: accepts no arguments, so neither the foreign
+   * owner, the conflicting node ID, the stored content, nor any provenance can
+   * leak through this error. The fixed message and `code` are the entire signal.
+   *
+   * @returns a contextless `WikiGraphNodeOwnershipConflict` instance. See the
+   *   class-level JSDoc for the privacy rationale.
+   */
+  constructor() {
+    super("Graph write rejected because a node ID is unavailable for this entity.");
+    this.code = "WIKI_GRAPH_NODE_OWNERSHIP_CONFLICT";
+    this.name = "WikiGraphNodeOwnershipConflict";
+  }
+};
 var WikiTransactionError = class extends Error {
   constructor(message, options) {
     super(message, options);
@@ -1738,6 +1753,36 @@ var IngestionService = class {
       releaseIngestLocks();
     }
   }
+  /**
+   * Reject the whole write when any incoming node ID is already owned by a
+   * different entity. Runs entirely inside the supplied `tx`, through the
+   * repository abstraction, and — being the first thing `upsertGraphCore`
+   * does — before ontology resolution, which can itself persist a configured
+   * seed manifest.
+   *
+   * The lookup has no deleted-row filter, so a soft-deleted foreign row keeps
+   * its ID reserved. Only the lookup IDs are deduplicated; `params.nodes` and
+   * the later write loops keep their ordering and counts.
+   *
+   * The error is deliberately contextless — see WikiGraphNodeOwnershipConflict.
+   *
+   * @param entityId - the entity the caller is writing on behalf of. Foreign
+   *   rows under a different entity trigger the rejection.
+   * @param nodes - incoming node set; only the IDs are inspected, so callers
+   *   may pass the public `params.nodes` shape directly without slicing.
+   * @param tx - the open transaction. Reuses the same handle every later
+   *   statement in `upsertGraphCore` runs against, so atomicity is enforced
+   *   by the host transaction's commit/rollback, not by this method.
+   */
+  async assertGraphNodeOwnership(entityId, nodes, tx) {
+    const ids = [...new Set(nodes.map((node) => node.id))];
+    const existing = await this.entryRepo.findExistingMetadataByIds(ids, tx);
+    for (const row of existing) {
+      if (row.entity_id !== entityId) {
+        throw new WikiGraphNodeOwnershipConflict();
+      }
+    }
+  }
   /**
    * Implements spec §2 data flow steps a–j with the host-facing
    * `{sourceRef, sourceHash, nodes, edges}` parameter shape. Shared between
@@ -1756,8 +1801,19 @@ var IngestionService = class {
    * @returns Counts: nodesWritten (validated nodes persisted), edgesWritten
    *   (manifest-valid edges persisted), superseded (prior facts soft-deleted
    *   plus prior source-ref edges hard-deleted).
+   *
+   * Node-ownership pre-flight (spec §3, REQ-GRAPH-01): the first statement
+   * is `assertGraphNodeOwnership(entityId, params.nodes, tx)`, which runs
+   * before ontology resolution, seed-manifest persistence, and every other
+   * write. A foreign-owned ID throws `WikiGraphNodeOwnershipConflict` with
+   * no disclosed owner, node ID, or content; the caller's transaction
+   * remains open and must be rolled back by the host. Soft-deleted foreign
+   * rows keep their IDs reserved. Duplicate incoming IDs are deduplicated
+   * only for the lookup; `params.nodes` and the write loops keep their
+   * ordering and counts so success counts match the pre-change contract.
    */
   async upsertGraphCore(entityId, params, tx, opts) {
+    await this.assertGraphNodeOwnership(entityId, params.nodes, tx);
     const now = Date.now();
     const ontologyState = await this.ontologyService?.getEffectiveState(entityId, tx) ?? { mode: "off", manifest: { node_types: [], edge_types: [] } };
     let { mode, manifest } = ontologyState;