daftari 1.29.0 → 1.30.0

package/CHANGELOG.md

@@ -7,6 +7,181 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.30.0] - 2026-07-13
+
+### Added
+
+- **`vault_receipt` — the epistemic receipt.** A new read-only MCP tool that
+  compiles, for the set of documents an answer cites, a single attachable
+  artifact: per-source status / confidence / provenance / freshness (decay),
+  the exact content-version hash, a filesystem-walked resolution of the
+  supersession chain (`resolved` / `restricted` / `dangling` / `cycle`), and
+  every unresolved tension touching the source — plus a deterministic summary
+  (`byStatus`, `openTensions`, oldest/newest `updated`, sorted
+  machine-readable flags such as `cites-stale`, `cites-contested`,
+  `cites-superseded`, `supersession-unresolved`; empty flags mean current,
+  grounded, and uncontested), the vault's git HEAD as an as-of anchor, and a
+  recomputable SHA-256 over the whole receipt. Discipline: the receipt only
+  reads (frontmatter, tension log, git); flags are deterministic derivations;
+  the optional caller-supplied `claim` rides verbatim and is never
+  interpolated into Daftari-authored text. RBAC mirrors the read path: a
+  receipt over an unreadable collection is denied, an unreadable supersession
+  hop degrades to `restricted`, and a tension is visible only when both
+  sources' collections are readable (the `vault_status` precedent). README
+  tool list updated to the full 26-tool surface (the "14 tools" count
+  predated the edge / staged-action / tension-graph tools).
+
+- **`daftari asof` — belief archaeology.** A read-only CLI report over the
+  vault's git history: `daftari asof <ref-or-date>` resolves a git ref or a
+  `YYYY-MM-DD` date (the last commit on or before that day) and reports the
+  vault's belief state at that point plus the drift since — documents
+  added/removed, `status`/`confidence` transitions, body-change counts, and
+  tensions opened or resolved (the committed `.daftari/tensions.md` is parsed
+  at both points with the live parser via the newly exported
+  `parseTensionLog`). `--doc <path>` adds a single-document trajectory
+  (frontmatter then vs now, every commit touching it since); `--blast <path>`
+  adds a **counterfactual replay** — the blast radius of the document
+  computed over the tree *as of the commit* (reusing `computeBlast` and the
+  reverse source/link maps from `vault_tension_blast`), each downstream
+  document annotated with its status today ("this fact turned out wrong — who
+  had inherited it, and where are they now?"). Strictly read-only plumbing:
+  `git ls-tree` + one `git cat-file --batch` process for the whole historical
+  tree — no checkout, no worktree, no index, no API key. Historical trees are
+  filtered with the live loader's exclusion rules (dotfiles, `.daftari/`,
+  `node_modules`, `.obsidian/`, `.trash/`) so then/now diffs can't report
+  phantom drift. Markdown to stdout, `--output` / `--output-json` to files;
+  audit-convention exit codes (0 report, 2 config/usage, 3 runtime). Pairs
+  with `vault_receipt`: a receipt's `vaultHead` is the anchor to hand back to
+  `asof`.
+
+- **`daftari court` — the Tension Court.** Common-law memory over the
+  tension log. `daftari court` compiles a **docket**: every open tension
+  briefed and ranked by priority (aging tier stale→fresh, then blast size,
+  then age) — both sides' claims verbatim with the present status and decay
+  of their documents ("gone" when a side was deleted), the union blast
+  radius a ruling would settle (reusing `computeBlast` and the
+  reverse-source/link maps from `vault_tension_blast`), tension-cluster
+  membership, and **precedents**: past rulings retrieved by a deterministic
+  three-tier match (shared-document > collection-pair > same-kind; newest
+  first within a tier, capped at 3, no LLM). `--tension <id>` renders a
+  single case's full brief including precedent rationales verbatim.
+  `daftari court rule <id> --kind superseded|corrected|accepted|invalid
+  [--rationale …] [--references …] [--by …]` records the ruling through the
+  same `resolveTension` write path as `vault_tension_resolve`; the rationale
+  is recorded verbatim and cited by future dockets — a ruling is precedent
+  the moment it lands, because a precedent IS a resolved tension. The court
+  retrieves and briefs; it never decides, and a ruling never edits the
+  disputed documents. Markdown to stdout, `--output` / `--output-json`;
+  audit-convention exit codes (0/2/3).
+
+- **`daftari sleep` — circadian memory** (positioning idea 6, gate cleared by
+  the CB7 result). A nightly metabolic pass composing machinery that already
+  exists — deterministic, LLM-free, and write-free with respect to documents:
+  sweeps expired staged actions, scores every document's decay, and builds
+  the **wake list** (canonical accumulation docs past TTL with downstream
+  dependents, ranked by blast radius via the `vault_tension_blast` reverse
+  maps), written to a gitignored `.daftari/wake-queue.jsonl` snapshot for an
+  external agent to re-verify against sources — the vault never re-verifies
+  on its own. The domain split is honored: generative docs going stale are
+  expected — counted, never woken; expired docs with no dependents are
+  reported as quiet decay, not woken. The **Morning Report** surfaces tension
+  aging and the court docket head, the ratification queue with
+  soon-to-expire proposals, and the rubber-stamp monitor (zero rejections
+  over ≥10 decisions prints a warning — the circadian design's kill-condition
+  instrumentation). Scheduling stays the OS's job (cron example in
+  `--help`); daftari ships the cycle, not a daemon. Markdown to stdout,
+  `--output` / `--output-json`, `--wake-limit` (report rows only — the queue
+  always carries the full list, no silent caps), `--no-queue`;
+  audit-convention exit codes. `.daftari/wake-queue.jsonl` added to the vault
+  gitignore template.
+
+- **`vault_witness` — agent track records + the wager layer** (positioning
+  ideas 4 and 9, gate cleared by the CB7 result). A read-only MCP tool that
+  aggregates the vault's own ledgers — provenance log, tension log, staged
+  actions — into a per-principal track record, priced by a provisional,
+  exported wager schedule (`low` 0 / `medium` 1 / `high` 3; survival credit
+  1; gone-doc burn 1 — calibration constants, like the §11.5 impact table).
+  Per principal: write volume and span (the longitudinal series for idea 9's
+  kill condition), docs authored (first provenance entry wins; authenticated
+  `principal` outranks the free-text `agent` claim), live claims with open
+  exposure, contested claims with stake at risk, the settled book (claims
+  corrected by ruling, retired, or deleted burn their stake; claims
+  maintained through a full TTL cycle earn credit; `balance` is the
+  difference), proposal outcomes, and tensions logged. Includes the
+  flat-curve monitor (idea 4's kill condition): one principal at ≥95% of
+  writes flags the records as uninformative instead of reporting them as
+  signal. RBAC follows the `vault_status` precedent — everything is scoped
+  to readable collections. Advisory and deterministic; nothing is enforced,
+  no document is touched, edge-observer attribution is deferred (the edge
+  log's collapse keeps observers internal). Tool surface is now 27.
+
+- **`vault_search` hits carry unresolved tensions inline** (`contested` /
+  `contestedCount`). Each annotation is the full two-sided marker — both
+  claims, kind, counterpart, tension id — post-joined from
+  `.daftari/tensions.md` in the same enrichment pass as `currentSource`,
+  capped at 3 per hit with an honest total. RBAC-gated on the counterpart's
+  collection (unreadable ⇒ omitted entirely, and excluded from the count).
+  Measured motivation: the tension-graph feud benchmark (2026-07-04) — on
+  feuds where retrieval buries one side, agents surface the contradiction
+  ~8% baseline vs ~46% with the tension inline; the dedicated-tool shape
+  loses to inline across all panel models. Tensions remain advisory and
+  never affect ranking.
+
+- **OpenRouter LLM transport for `daftari consolidate`** (`--transport
+  anthropic|openrouter`, env fallback `DAFTARI_LLM_TRANSPORT`). A second
+  model-family client (`createOpenRouterClient`) implementing the same
+  `LlmClient` contract as the Anthropic client, promoted from the
+  decorrelation shim. On the openrouter transport the CLI gates on
+  `OPENROUTER_API_KEY` (not `ANTHROPIC_API_KEY`), defaults the model to
+  `anthropic/claude-haiku-4.5`, and accepts any OpenRouter slug via `--model`.
+  This is the substrate for the Stage-5 multi-model graduation gate (spec §12
+  amendment, 2026-07-02): single-family panel votes are ~92% error-correlated,
+  so `k_survived` needs a second model family before any auto-write tier can
+  graduate. `completeWithTools` is deliberately unsupported on this transport
+  (only `daftari eval` drives tools; eval stays on anthropic).
+
+### Security
+
+- **Tension tools now enforce the both-sides visibility rule** (#212).
+  `vault_tension_clusters` and `vault_tension_blast` compute over only the
+  tensions whose BOTH sides the caller can read — filtered before
+  aggregation, so counts, cluster sizes, and blast seeds reveal nothing
+  about hidden entries. `vault_tension_log` refuses to record claims naming
+  a document the caller cannot read (denial names the caller-supplied path
+  only); `vault_tension_resolve` returns the exact not-found error for
+  invisible tensions, checked before the loop-authored ratify rule. This
+  closes the bypass around #211's contested-annotation gate: one rule
+  (`collectionForPath` + `canSeeTension`) now governs every tension
+  surface. No-RBAC deployments are unaffected. Known residual (accepted):
+  sequential tension ids still reveal the total entry count to callers who
+  can log. A follow-up consolidation (`sourceReadable`, exported from
+  `tension-access.ts`) then unified the canonicalize → reject-escape →
+  `canRead` sequence into a single predicate adopted by all four call
+  sites — the tension log/blast gates above and #211's contested-annotation
+  filter in `contested.ts` — so one guard now backs every tension-graph tool surface,
+  including contested annotations on `vault_search` hits. Further
+  residuals (accepted, tracked in follow-ups): `vault_status` /
+  `vault_receipt` / court-precedent tension summaries still filter by
+  uncanonicalized top-level segment, and `vault_lint`'s tension-health
+  aggregates count all entries (counts only, no content).
+
+### Internal
+
+- **CB7 decision-divergence bench** (`integrations/consensus-bench`,
+  benchmark tooling only). Implements the
+  2026-07-11 CB7 design: instance assembly from existing artifacts (CB6
+  tension pairs, CO2 stale-trap diffs, consensus-box supersession chains as
+  settled controls — CB6 tension items excluded from the control set),
+  condition renderer with locked validity invariants (task text
+  byte-identical across memory conditions; the collapsed block carries one
+  value and no epistemic language; settled controls give the foil the
+  governing value), deterministic enum scorer (divergence, calibration,
+  hedge tax — no LLM judge on primary metrics), and `cb7-runner.mjs` for the
+  live panel run (`--gate` mode runs the second-rater leakage check).
+  M-collapsed for tensions holds the challenger position (recency /
+  last-write-wins) rather than the spec's CB6-foil-verdict, a deterministic
+  deviation recorded in the module.
+
 ## [1.29.0] - 2026-06-25
 
 ### Changed

package/README.md

@@ -56,7 +56,7 @@ compiles; the vault preserves; *you* keep the judgment. See
 
 ## What it is
 
-A directory of markdown files with YAML frontmatter, exposed to agents as 14
+A directory of markdown files with YAML frontmatter, exposed to agents as 27
 MCP tools over stdio. The vault is plain text: you can read it in any editor,
 `git log` it, grep it. Daftari adds the machinery agents need to treat it as a
 shared workspace.
@@ -70,7 +70,10 @@ Point any MCP client (Claude Desktop, Claude Code, an agent SDK) at it.
 
 ## The four layers
 
-Storage and access control are table stakes. The moat is layers 3 and 4.
+All four implement one idea — *resolve only by discovery, never by invention.*
+Read [**The core idea**](docs/architecture.md#the-core-idea) first and the layers
+become its consequences. Storage and access control are table stakes; the moat is
+layers 3 and 4.
 
 |Layer                |What it does                                                                                          |Why it matters                                                         |
 |---------------------|------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
@@ -83,11 +86,31 @@ Storage and access control are table stakes. The moat is layers 3 and 4.
 
 **Read:** `vault_read`, `vault_index`, `vault_status`
 
-**Search:** `vault_search` (hybrid BM25 + vector), `vault_search_related`, `vault_themes` (thematic clustering), `vault_reindex`
+**Attest:** `vault_receipt` — compile an epistemic receipt for the documents
+an answer cites: per-source status, confidence, provenance, freshness, exact
+content-version hash, supersession-chain resolution, and open tensions, plus
+deterministic summary flags, the vault's git HEAD as an as-of anchor, and a
+recomputable hash over the whole receipt. Attach it to the answer so any
+consumer can see what the answer stands on.
 
-**Write:** `vault_write`, `vault_append`, `vault_promote`, `vault_deprecate`
+**Witness:** `vault_witness` — per-principal track records from the vault's
+own ledgers, priced by the wager schedule: write volume, live claims with
+open exposure, contested claims with stake at risk, the settled book
+(burned vs credited), proposal outcomes, tensions logged. Advisory and
+deterministic; includes the flat-curve monitor so a single-author vault is
+reported as uninformative rather than as signal.
 
-**Curate:** `vault_tension_log`, `vault_lint`, `vault_provenance`
+**Search:** `vault_search` (hybrid BM25 + vector; hits carry their unresolved
+tensions inline and foreground the current source of superseded documents),
+`vault_search_related`, `vault_themes` (thematic clustering), `vault_reindex`
+
+**Write:** `vault_write`, `vault_append`, `vault_promote`, `vault_deprecate`, `vault_supersede`, `vault_merge`, `vault_set_confidence`
+
+**Curate:** `vault_tension_log`, `vault_tension_resolve`, `vault_tension_clusters`, `vault_tension_blast`, `vault_lint`, `vault_provenance`
+
+**Edges:** `vault_edge_observe`, `vault_edge_contest`, `vault_edges`
+
+**Ratify:** `vault_stage_action`, `vault_ratify`
 
 The curation engine is advisory: `vault_lint` reports problems and
 `vault_tension_log` records contradictions. Neither auto-fixes anything. Every
@@ -402,6 +425,102 @@ fail_on:
   transitive_staleness: 100          # default: generous; teams tune
 ```
 
+## The vault as witness — and the wager layer
+
+Every write already carries an identity, every proposal an outcome, every
+tension a logger and a ruling. `vault_witness` aggregates that ledger into a
+**track record per principal** — and prices it. Confidence is free to claim,
+so the wager schedule makes it cost something: writing at `high` stakes 3
+points, `medium` 1, `low` 0 (hedged claims are the honest default and are
+never taxed). A claim later corrected by a ruling or retired by someone else
+burns the stake; a claim maintained through a full TTL cycle earns credit.
+The balance is arithmetic on recorded facts — advisory, provisional
+constants, nothing enforced: routing a high-stakes write to the agent with
+the earned balance is your policy, not the vault's. Both kill conditions
+from the design travel with the tool: the flat-curve monitor (one author ≥95%
+of writes → curves declared uninformative) and the longitudinal write-volume
+series (if stake-fear suppresses honest claims, it shows up here first).
+
+## Circadian memory
+
+The vault sleeps. `daftari sleep` is the nightly metabolic pass — deterministic,
+LLM-free, write-free (documents are never touched):
+
+```bash
+# In cron (any scheduler works; daftari ships the cycle, not a daemon):
+0 3 * * * cd /path/to/vault && npx daftari sleep --output .daftari/morning-report.md
+```
+
+The cycle sweeps expired staged actions, scores every document's decay, and
+builds the **wake list**: canonical accumulation documents past their TTL
+with downstream dependents, ranked by blast radius. The list is written to
+`.daftari/wake-queue.jsonl` for an external agent to consume — re-verify each
+document against its sources, stage the diff — because the vault never
+re-verifies on its own. Generative documents going stale are expected, not a
+defect: counted, never woken.
+
+The **Morning Report** ends where the human begins: tension aging and the
+court docket head, the ratification queue with soon-to-expire proposals, and
+the rubber-stamp monitor — zero rejections over a long decision history is
+printed as a warning, not a compliment. The agent proposes overnight; you
+ratify over coffee.
+
+## Tension Court
+
+Tensions wait in a log; the court turns them into decidable cases. `daftari
+court` compiles a **docket** — every open tension briefed and ranked (stale
+first, then by blast radius): both sides' claims, the present state of their
+documents, the downstream stakes, cluster membership, and **precedents** —
+past rulings on disputes that shared a document, a collection pair, or a
+kind.
+
+```bash
+# The docket — a 5-minute weekly ritual
+daftari court --vault ./my-vault
+
+# One case's full brief (verbatim rationales from cited precedents)
+daftari court --tension tension-abc123
+
+# Rule. The rationale is recorded verbatim and cited by future dockets.
+daftari court rule tension-abc123 --kind corrected \
+  --rationale "Vendor pricing page confirmed the entry tier on 2026-07-10."
+```
+
+Rulings go through the same `resolveTension` write path as
+`vault_tension_resolve` — a ruling records the closure, it never edits the
+disputed documents. Precedent retrieval is deterministic (shared-document >
+collection-pair > same-kind; no LLM): the court retrieves how this house has
+resolved similar disputes before, and whether a precedent applies stays the
+human's judgment. Memory grows case law.
+
+## Belief archaeology
+
+Git is the version layer, so the vault can answer **"what did we believe on
+March 3?"** `daftari asof` is a read-only report over the repo's history — no
+checkout, no index, no API key:
+
+```bash
+# The vault's belief state at a date (or any git ref), plus the drift since
+daftari asof 2026-03-03 --vault ./my-vault
+
+# One document's trajectory: frontmatter then vs now, commits in between
+daftari asof HEAD~20 --doc pricing/helios-consumption-pricing.md
+
+# Counterfactual replay: this fact turned out wrong — who had inherited it
+# at the time, and where are they now?
+daftari asof 2026-03-03 --blast pricing/helios-consumption-pricing.md
+```
+
+The default report shows the document and tension state at that point and
+the drift since: documents added/removed, `status`/`confidence` transitions,
+and tensions opened or resolved. `--blast` computes the blast radius of a
+document over the tree *as of the commit* (same source/link edge semantics as
+`vault_tension_blast`), annotating each downstream document with its status
+today — the post-mortem view for a fact that was later corrected. Markdown to
+stdout by default; `--output` / `--output-json` write files. Pairs with
+`vault_receipt`: a receipt's `vaultHead` is exactly the anchor to hand back
+to `asof`.
+
 ## Development
 
 ```

package/dist/asof/git-read.d.ts

@@ -0,0 +1,17 @@
+import { type Result } from "../frontmatter/types.js";
+export interface AsofCommit {
+    hash: string;
+    date: string;
+    subject: string;
+}
+export declare function resolveAsofCommit(vaultRoot: string, refOrDate: string): Promise<Result<AsofCommit, Error>>;
+export declare function listTreeDocs(vaultRoot: string, commit: string): Promise<Result<string[], Error>>;
+export declare function readBlobsAt(vaultRoot: string, commit: string, paths: string[]): Promise<Result<Map<string, string>, Error>>;
+export interface RangeCommit {
+    hash: string;
+    date: string;
+    author: string;
+    subject: string;
+}
+export declare function logRangeForPath(vaultRoot: string, since: string, path: string): Promise<Result<RangeCommit[], Error>>;
+//# sourceMappingURL=git-read.d.ts.map

package/dist/asof/git-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-read.d.ts","sourceRoot":"","sources":["../../src/asof/git-read.ts"],"names":[],"mappings":"AAWA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAqB/D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAwBpC;AAaD,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAMlC;AAMD,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAuD7C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAmBvC"}

package/dist/asof/git-read.js

@@ -0,0 +1,163 @@
+// Read-only git plumbing for `daftari asof` — belief archaeology.
+//
+// Git is Daftari's version layer, so "what did we believe on March 3?" is a
+// question git can already answer: resolve the date to a commit, read the
+// tree at that commit, parse the same markdown the live tools parse. This
+// module is strictly read-only — it never touches the work tree, never
+// creates a worktree or checkout, and writes nothing to the repo. All reads
+// go through `git ls-tree` / `git cat-file --batch` / `git log`.
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { err, ok } from "../frontmatter/types.js";
+const run = promisify(execFile);
+async function git(vaultRoot, args) {
+    try {
+        const { stdout } = await run("git", ["-C", vaultRoot, ...args], {
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        return ok(stdout);
+    }
+    catch (e) {
+        const reason = e instanceof Error && "stderr" in e && typeof e.stderr === "string"
+            ? e.stderr.trim() || e.message
+            : e instanceof Error
+                ? e.message
+                : String(e);
+        return err(new Error(`git ${args[0]} failed: ${reason}`));
+    }
+}
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+// Resolves the user's `<ref-or-date>` to a commit. A YYYY-MM-DD date means
+// "the last commit made on or before the end of that day" (committer date,
+// local time — the same clock the commits were made on). Anything else is
+// handed to rev-parse as a ref (HEAD~3, a branch, a hash, a tag).
+export async function resolveAsofCommit(vaultRoot, refOrDate) {
+    if (typeof refOrDate !== "string" || refOrDate.trim().length === 0) {
+        return err(new Error("asof requires a non-empty ref or YYYY-MM-DD date"));
+    }
+    const input = refOrDate.trim();
+    let hash;
+    if (DATE_RE.test(input)) {
+        const listed = await git(vaultRoot, ["rev-list", "-1", `--before=${input} 23:59:59`, "HEAD"]);
+        if (!listed.ok)
+            return listed;
+        hash = listed.value.trim();
+        if (hash.length === 0) {
+            return err(new Error(`no commit exists on or before ${input}`));
+        }
+    }
+    else {
+        const parsed = await git(vaultRoot, ["rev-parse", "--verify", `${input}^{commit}`]);
+        if (!parsed.ok)
+            return err(new Error(`cannot resolve '${input}' to a commit`));
+        hash = parsed.value.trim();
+    }
+    const meta = await git(vaultRoot, ["show", "-s", "--format=%H%x1f%cs%x1f%s", hash]);
+    if (!meta.ok)
+        return meta;
+    const [fullHash, date, subject] = meta.value.trim().split("\x1f");
+    return ok({ hash: fullHash ?? hash, date: date ?? "", subject: subject ?? "" });
+}
+// Path segments the live loader never sees (listFiles ignores dotfiles,
+// .daftari, node_modules, .obsidian, .trash) — the historical tree must be
+// filtered identically or then/now diffs would report phantom drift.
+function isManagedDocPath(path) {
+    if (!path.endsWith(".md"))
+        return false;
+    const segments = path.split("/");
+    return segments.every((s) => !s.startsWith(".") && s !== "node_modules");
+}
+// Vault-relative paths of the managed markdown documents in the tree at
+// `commit`, sorted (matching listFiles' sorted output).
+export async function listTreeDocs(vaultRoot, commit) {
+    const listed = await git(vaultRoot, ["ls-tree", "-r", "--name-only", "-z", commit]);
+    if (!listed.ok)
+        return listed;
+    const paths = listed.value.split("\0").filter((p) => p.length > 0 && isManagedDocPath(p));
+    paths.sort();
+    return ok(paths);
+}
+// Reads many blobs from one commit in a single `git cat-file --batch`
+// process. Returns a map of path → file content; a path that does not exist
+// at the commit is simply absent from the map. One spawn total, so reading a
+// 3,500-file historical tree costs one process, not 3,500.
+export async function readBlobsAt(vaultRoot, commit, paths) {
+    if (paths.length === 0)
+        return ok(new Map());
+    return new Promise((resolvePromise) => {
+        const child = spawn("git", ["-C", vaultRoot, "cat-file", "--batch"], {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        child.stdout.on("data", (c) => stdoutChunks.push(c));
+        child.stderr.on("data", (c) => stderrChunks.push(c));
+        child.on("error", (e) => {
+            resolvePromise(err(new Error(`git cat-file failed to spawn: ${e.message}`)));
+        });
+        child.on("close", (code) => {
+            if (code !== 0) {
+                const reason = Buffer.concat(stderrChunks).toString("utf-8").trim();
+                resolvePromise(err(new Error(`git cat-file exited ${code}: ${reason}`)));
+                return;
+            }
+            // Batch output, per requested object, in request order:
+            //   "<oid> <type> <size>\n" + <size> bytes + "\n"    — found
+            //   "<input> missing\n"                              — absent
+            // Sizes are BYTE counts, so parsing walks the raw Buffer, decoding
+            // each content slice to UTF-8 only after it is bounded.
+            const out = Buffer.concat(stdoutChunks);
+            const contents = new Map();
+            let offset = 0;
+            for (const path of paths) {
+                const nl = out.indexOf(0x0a, offset);
+                if (nl === -1) {
+                    resolvePromise(err(new Error("git cat-file: truncated batch output")));
+                    return;
+                }
+                const header = out.subarray(offset, nl).toString("utf-8");
+                offset = nl + 1;
+                if (header.endsWith(" missing"))
+                    continue;
+                const parts = header.split(" ");
+                const size = Number(parts[2]);
+                if (!Number.isFinite(size) || size < 0) {
+                    resolvePromise(err(new Error(`git cat-file: unparseable header: ${header}`)));
+                    return;
+                }
+                contents.set(path, out.subarray(offset, offset + size).toString("utf-8"));
+                offset += size + 1; // skip the trailing \n after the content
+            }
+            resolvePromise(ok(contents));
+        });
+        for (const path of paths)
+            child.stdin.write(`${commit}:${path}\n`);
+        child.stdin.end();
+    });
+}
+// Commits in `<since>..HEAD` touching `path`, newest first. The trajectory
+// view uses this to show every revision a document went through since the
+// as-of point.
+export async function logRangeForPath(vaultRoot, since, path) {
+    const result = await git(vaultRoot, [
+        "log",
+        "--format=%H%x1f%cs%x1f%aN%x1f%s%x1e",
+        `${since}..HEAD`,
+        "--",
+        path,
+    ]);
+    if (!result.ok)
+        return result;
+    const commits = [];
+    for (const record of result.value.split("\x1e")) {
+        const trimmed = record.trim();
+        if (!trimmed)
+            continue;
+        const [hash, date, author, subject] = trimmed.split("\x1f");
+        if (!hash)
+            continue;
+        commits.push({ hash, date: date ?? "", author: author ?? "", subject: subject ?? "" });
+    }
+    return ok(commits);
+}
+//# sourceMappingURL=git-read.js.map

package/dist/asof/git-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-read.js","sourceRoot":"","sources":["../../src/asof/git-read.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,iEAAiE;AAEjE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAE/D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,KAAK,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAc;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,EAAE;YAC9D,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GACV,CAAC,YAAY,KAAK,IAAI,QAAQ,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YACjE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO;YAC9B,CAAC,CAAC,CAAC,YAAY,KAAK;gBAClB,CAAC,CAAC,CAAC,CAAC,OAAO;gBACX,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,SAAiB;IAEjB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE/B,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,KAAK,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC;AAC3E,CAAC;AAED,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,MAAc,EACd,KAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAE7C,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;YACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpE,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YAED,wDAAwD;YACxD,6DAA6D;YAC7D,8DAA8D;YAC9D,mEAAmE;YACnE,wDAAwD;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC3C,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACd,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;oBACvE,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC1D,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,SAAS;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACvC,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1E,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,yCAAyC;YAC/D,CAAC;YACD,cAAc,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AASD,2EAA2E;AAC3E,0EAA0E;AAC1E,eAAe;AACf,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE;QAClC,KAAK;QACL,qCAAqC;QACrC,GAAG,KAAK,QAAQ;QAChB,IAAI;QACJ,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}

package/dist/asof/index.d.ts

@@ -0,0 +1,2 @@
+export declare function runAsof(argv: string[]): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/asof/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/asof/index.ts"],"names":[],"mappings":"AA2DA,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF7D"}