drafted 1.24.2 → 1.24.4

package/plugin/skills/drafted/SKILL.md

@@ -1,102 +0,0 @@
----
-name: drafted
-description: Use the Drafted producibles harness — a compounding workspace that uplifts any AI across three primitives: knowledge (the org wiki), procedures (skills), and the project surface (frames on a shared real-time canvas). Drafted is navigated like a filesystem — one fs tool, one path grammar, org first: `fs(ls, path="/")` lists your orgs, then `/o/<org>/<root>/...`. Prime from the harness before working, build durable artifacts as frames instead of burying output in chat, and deposit what you learned back so the next session starts smarter. When Google Drive is connected, prefer Google Workspace frames for docs, sheets, and slides. When the local `gws` CLI is signed in, read the user's Gmail, Drive and Calendar with it as source material and build the result in Drafted.
----
-
-# Drafted — a producibles harness that compounds
-
-Drafted makes any AI more effective by giving it a memory and a workspace that get better with use. It has three primitives that layer:
-
-- **Knowledge — the org wiki.** Durable facts, decisions, conventions. *More knowledge = less searching.*
-- **Procedures — skills.** Reusable SOPs the org has encoded. *Better skills = more stable process.*
-- **Surface — projects.** Reviewable work as frames on a shared zoomable canvas the user watches live at `https://drafted.live`. *Reusable projects + anchors = velocity with accuracy.*
-
-The point is the **compounding loop**: you don't produce in a vacuum, you draw on what the org already knows and leave it richer each pass.
-
-## The surface is a filesystem — one tool, one path grammar
-
-There is exactly **one** tool to know: `fs`. It looks, feels, and behaves like a local filesystem, and an **org is the top folder** — you address an org, you never switch to it:
-
-```
-fs(ls, path="/")                                   → the orgs you belong to
-fs(ls, path="/o/<org>")                            → that org's wiki · skills · projects
-/o/<org>/wiki/<path>                                org knowledge pages (markdown, free nesting)
-/o/<org>/skills/<slug>                              reusable procedures (flat: one dir per skill)
-/o/<org>/projects/<project>/<layer>/<lane>/<file>   frames on the surface (project → layer → lane → file)
-```
-
-Verbs: `ls` (list) · `read` (cat, hashline-annotated) · `write` (create/overwrite) · `edit` (hashline ops) · `mv` (rename/move) · `rm` (move to archive) · `mkdir` (create a project) · `search` (grep).
-
-**A project is a folder.** It starts with **no layers** — writing to `/o/<org>/projects/<name>/<layer>/...` auto-creates the layer (mkdir -p). The agent defines the filesystem structure by writing into it. URLs are the same paths: `https://drafted.live/o/<org>/projects/<project>/<layer>/<lane>/<file>` — the URL's pathname IS the fs path (one canonical link for both humans and agents). Bare `/wiki`, `/skills`, `/projects` roots still work via the session's working org.
-
-## The loop — prime → build → compound
-
-- **Prime (session start).** Pull accumulated value in. The system *enforces* this: you must search the wiki before working (G1), and the skills anchored to an org, folder or project must be read before you change content there (a refused write returns HTTP 428 `anchor_gate` with the rule text; read the skill, then retry). Don't fight the gates — they make you start smart.
-- **Build (the work).** Produce artifacts as frames on the surface.
-- **Compound (session end / when you notice something).** Deposit learning back: capture knowledge, distill or fix a skill, harden the project. This is *your* responsibility — the system can't force it, so do it.
-
-## The gates you'll encounter (and how to satisfy them)
-
-These reset every session. A gate that blocks you tells you exactly what to call next — do it, don't work around it.
-
-- **G1 — wiki search before work.** Before reading or editing anything, `fs(search, path="/o/<org>/wiki", query="<terms>")` for relevant org knowledge.
-- **G2 — prior-art before a new skill.** Writing a new `/o/<org>/skills/<slug>` requires `fs(search, path="/o/<org>/skills", query="<topic>")` first.
-- **G3 — prior-art before a new project.** Creating a project requires wiki + skill searches first.
-- **G4 — anchored skills** gate every content write (frames, wiki pages, skills) in the scope they are anchored to: an org, a folder or a project. The refusal (HTTP 428 `anchor_gate`) carries the rule text and the `fs(read)` path of each skill; read them, then retry. Editing a skill re-arms the gate. They are how the org does this work.
-- **G5 — the project's anchored frames** are suggested reading (briefs, constraints, style guides). The server does not enforce them.
-- **G6 — a layer's rules** are surfaced when you work in that layer. Honor them.
-
-## The commands (when to reach for each)
-
-These bookend the loop. Prime/feed at the start, deposit at the end.
-
-- `/drafted:onboard-drafted` — first run: orient + bootstrap the harness (seed wiki, starter skills, first project).
-- `/drafted:ingest` — bring knowledge into the wiki (a research output, existing documents, or by interrogating the user).
-- `/drafted:create-skill` — capture a repeatable procedure (with knowledge + prior-art search).
-- `/drafted:create-project` — start a project or a reusable template (with knowledge/skill/template search).
-- `/drafted:improve-wiki` — fix stale / wrong / fragmented knowledge.
-- `/drafted:improve-skill` — fix a skill that underperformed.
-- `/drafted:improve-project-harness` — turn corrections into enforced gates (anchors / attached skills / layer rules).
-- `/drafted:extract` — session-end: deposit knowledge, a skill, and/or a template (the user picks which).
-
-## Working on the surface
-
-- **Navigate by path, exactly like a filesystem.** `fs(ls, path="/")` to see your orgs; `fs(ls, path="/o/<org>/projects")` to see a project list; `fs(ls, path="/o/<org>/projects/<project>")` for layers/lanes; `fs(ls, path="/o/<org>/projects/<project>/<layer>")` for frames. The project is resolved from the path itself — no separate "open" step.
-- **Create a project with `fs(mkdir, path="/o/<org>/projects/<name>")`** — or just `fs(write, path="/o/<org>/projects/<name>/<layer>/<lane>/<file>", content=...)` and the project + layer auto-create in the addressed org.
-- **Default to the surface for substantive artifacts.** When asked to draft, write, plan, analyze, compare, design, document, summarize, report, spec, model, or make a deck/table, create or update frames instead of leaving the durable result only in chat. One visible frame per artifact or section.
-- **Read before editing.** `fs(read)` returns every line hashline-annotated (`1abc|<content>`); `fs(edit, ops=[{type:"replace", lineHash:"1abc", newContent:"..."}])` targets exactly that line. For partial reads, pass `lines: "2-50"` — you get back just that range, still hash-annotated, and can edit within it.
-- **Prefer Google Workspace when Drive is connected.** `whoami` reports it — `googleDrive.connected: true` means use `fs(write, path=".../<name>.google-doc"|".google-sheet"|".google-slide")` for docs, sheets, and decks, populated immediately with the matching native write action. False means they cannot be created at all: use `.md`/`.html` frames and don't ask the user which fallback they want.
-- **`fs(mv, from="/o/<org>/projects/<p>/<layer>/<lane>/<file>", to="...")`** renames or moves (cross-project too). **`fs(rm, path="/o/<org>/projects/<project>")` archives** — agents never hard-delete; the archive is in the web UI.
-- **Return a clickable link** for what you touched — the `frameUrl`/`projectUrl` in the fs response is the URL the user opens.
-
-## Source material from Google (`gws`) — Drafted holds the work
-
-Local sessions may have Google's Workspace CLI, `gws`, signed in **read-only** to the user's **own** Google account (set up by the installer or `drafted google-setup`). Split the jobs: **`gws` reads what already exists** (mail, Drive files, calendar) on the user's machine with the user's token. **Drafted is where what you make from it lives, and the only way anything is sent.** Don't use Drafted as a mail store, and don't leave the result in chat.
-
-- **Check first.** `gws auth status` is ready when `has_refresh_token` is `true` and a scope contains `/auth/gmail`. Read those two fields; don't echo the whole output. If it isn't ready, suggest `! drafted google-setup` once (macOS/Linux; it's interactive, so the user runs it). Remote sessions (claude.ai, `/mcp`) have no `gws`, so skip this section there.
-- **Ask before you read.** The first inbox or Drive read in a session needs the user's yes and a scope ("last 30 days", "threads with Acme", "this folder"). Offer the narrowest useful one.
-- **Headers before bodies.** List with `gws gmail users threads list --params '{"userId":"me","q":"newer_than:30d -category:promotions -category:social","maxResults":50}'`. Get headers with `gws gmail users threads get --params '{"userId":"me","id":"<threadId>","format":"metadata","metadataHeaders":["From","Subject","Date"]}'` and triage on subject, participants and date. Open a body (`gws gmail +read --id <messageId>`) only for threads you will actually use. Drive: `gws drive files list --params '{"q":"trashed = false","orderBy":"modifiedTime desc","pageSize":50,"fields":"files(id,name,mimeType,modifiedTime,webViewLink)"}'`. When unsure of a method's shape, run `gws schema <service.resource.method>`.
-- **Synthesize, never copy.** A frame or wiki page carries your synthesis plus a link back to the source (`https://mail.google.com/mail/u/0/#all/<threadId>`, or the Drive file's `webViewLink`). It never carries pasted email bodies or other people's addresses. The surface is shared with collaborators; the inbox is not. Quote only what the user asks for, attributed.
-- **Every send goes through Drafted, and the user approves it.** `gws` is signed in read-only, and it stays that way. To send, draft the email, then `action(action="propose", type="send_email", payload='{"from":"<the user\'s own connected Gmail address>","to":"<one address>","subject":"<one line>","body":"<plain text>"}', reason="<one line: why>")`. The user reads it and approves it in the Drafted UI. Nothing is sent before that, and you cannot approve it yourself. It goes out AS the user, from their Gmail connected in Drafted Settings; if the proposal is refused because none is connected, tell them to connect it there. Never send by any other route (widening the `gws` sign-in, SMTP, another tool), even when asked to "just send it": propose, and point the user to the approval.
-- **Reply inside the thread.** When you answer an email, add `"threadId"` (the Gmail thread id) and `"inReplyTo"` (that message's `Message-ID` header, read with `gws gmail users messages get ... format=metadata`) to the `send_email` payload, so the reply lands in the same conversation for both sides.
-- **Connect the thread when a project grows out of an email.** `mail(action="connect", project="<project>", gmailThreadId="<id>", title="<your short name for it>")`, then ask the user what should happen when a reply comes in: **notify** (mark it in the project's Inbox) or **work** (their computer starts Claude Code on the reply, with only Drafted's tools, and nothing goes out without their approval). Drafted never reads the mail: the user's computer checks connected threads with their `gws` and reports only that a reply arrived. Use a title of your own, not an email subject full of personal details. After you have dealt with a reply, `mail(action="handled", id=...)` only if the user asked you to.
-
-## Quality conventions
-
-- **Match format to layer intent.** Research/strategy/copy are usually markdown; visual work (wireframes, designs, dashboards) is HTML.
-- **Wireframes are low-fidelity** (grayscale, placeholders); reserve color and real content for the designs/final layer.
-- **Choose dimensions to fit content** — `autoSize: true` for HTML, or explicit `width`/`height`.
-- **Don't re-read unchanged frames** you already have this conversation.
-- **Diagrams: prefer native Excalidraw.** For flowcharts, process maps, architecture/system/data-flow diagrams, or visual maps, write a `.excalidraw` file (scene JSON) and load the `excalidraw-drafted` skill for the authoring guidance. Use HTML/markdown frames for web/UI mockups, rich layouts, or non-editable artifacts.
-
-## Skill authoring
-
-- **Git is the source of truth for skills; Drafted renders, indexes, and searches.** When a repo is connected to a folder, the skills under `.agents/skills/` in that repo ARE the skills for that folder — authoring happens by committing to git, not by writing into Drafted. Drafted write paths for a repo-owned skill return `409 repo_owned` naming the repo, branch, and path to commit to. Use `repo(action="rescan")` after a push so the index reflects the change.
-- **For a folder with NO connected repo, author skills in Drafted** with `fs(write, path="/o/<org>/skills/<slug>", content=..., readme=...)` (G2 gate first). A `README.md` (the `readme` param) is optional but recommended — it is what renders for the skill directory on GitHub if the skill is ever exported; omitting it creates the skill with a warning. A skill is a directory: `fs(write, path="/o/<org>/skills/<slug>/README.md", content=...)` and any other supporting file work once the skill exists, and `fs(ls, path="/o/<org>/skills/<slug>")` lists them. `fs(mv, path="/o/<org>/skills/<old>", to="/o/<org>/skills/<new>")` renames.
-- **Knowledge goes in the wiki, procedure in skills.** Drafted owns org knowledge (wiki pages via `fs` under `/o/<org>/wiki/`); git owns reusable procedure (skills under `.agents/skills/`). Don't put a skill body in a wiki page or a knowledge doc in a SKILL.md.
-- **Machine-specific build output is never portable.** Build `node_modules`, downloaded browsers, compiled binaries into a `.skillinstall/` directory inside the skill — Drafted always strips it on push and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe live in git/Drafted.
-- **Improve skills when you find a better way.** Fix or distill a skill that underperformed rather than leaving it stale.
-
-## Surface URL recognition
-
-Any URL containing `/f/{uuid}` is a Drafted frame link — `fs(read, path=URL)` gets its content. Canonical links are the fs paths themselves: `/o/<org>/wiki/...`, `/o/<org>/skills/<slug>`, `/o/<org>/projects/<project>/<layer>/<lane>/<file>`. Never `WebFetch` Drafted URLs — the MCP tools authenticate properly.

package/server/lib/umami.mjs

@@ -1,164 +0,0 @@
-export const UMAMI_EVENTS = Object.freeze({
-  SIGNUP_STARTED: 'signup_started',
-  SIGNUP_COMPLETED: 'signup_completed',
-  ORG_CREATED: 'org_created',
-  PROJECT_CREATED: 'project_created',
-  PROJECT_OPENED: 'project_opened',
-  TEMPLATE_USED: 'template_used',
-  FRAME_CREATED: 'frame_created',
-  FRAME_UPDATED: 'frame_updated',
-  FRAME_DELETED: 'frame_deleted',
-  SHARE_CREATED: 'share_created',
-  SHARE_ACCEPTED: 'share_accepted',
-  INVITE_SENT: 'invite_sent',
-  MCP_CONNECTED: 'mcp_connected',
-  MCP_TOOL_CALLED: 'mcp_tool_called',
-  WIKI_PAGE_CREATED: 'wiki_page_created',
-  SKILL_ATTACHED: 'skill_attached',
-  DRIVE_CONNECTED: 'drive_connected',
-  DRIVE_SYNC_COMPLETED: 'drive_sync_completed',
-  DRAFTED_INSTALL: 'drafted_install',
-  DRAFTED_UPDATE: 'drafted_update',
-  DRAFTED_HEARTBEAT: 'drafted_heartbeat',
-  DRAFTED_MCP_CONFIGURED: 'drafted_mcp_configured',
-  DRAFTED_MCP_REQUEST: 'drafted_mcp_request',
-  DRAFTED_MCP_ERROR: 'drafted_mcp_error',
-  DRAFTED_UPDATE_HELPER_STARTED: 'drafted_update_helper_started',
-  DRAFTED_UPDATE_HELPER_FAILED: 'drafted_update_helper_failed',
-  CTA_CLICKED: 'cta_clicked',
-  TEMPLATE_SELECTED: 'template_selected',
-  PROJECT_NAVIGATED: 'project_navigated',
-  SHARE_MODAL_OPENED: 'share_modal_opened',
-  SHARE_MODAL_ACTION: 'share_modal_action',
-  SURFACE_LOADED: 'surface_loaded',
-  SIDEBAR_USED: 'sidebar_used',
-  TOOL_PANEL_USED: 'tool_panel_used',
-});
-
-const BLOCKED_KEYS = new Set([
-  'email', 'userEmail', 'name', 'userName', 'orgName', 'projectName', 'label', 'title',
-  'content', 'html', 'markdown', 'body', 'prompt', 'token', 'cookie', 'authorization',
-  'password', 'secret', 'apiKey', 'request', 'headers', 'file', 'buffer', 'dataUrl',
-]);
-const ID_KEYS = new Set(['userId', 'orgId', 'projectId', 'projectSlug', 'frameId', 'shareId', 'skillId', 'templateId', 'templateSlug', 'userRole', 'role', 'buildId', 'pageType', 'tool', 'action', 'source', 'layer', 'lane', 'mode', 'installId', 'schemaVersion', 'installerVersion', 'cliVersion', 'osFamily', 'osVersion', 'arch', 'nodeVersion', 'npmVersion', 'claudeDesktop', 'claudeCode', 'codex', 'cursor', 'updateHelperStatus', 'mcpMode', 'errorCode', 'matchKey']);
-
-export function getUmamiConfig(config = {}) {
-  const hostUrl = (config.umamiHostUrl || process.env.UMAMI_HOST_URL || '').replace(/\/$/, '');
-  const websiteId = config.umamiWebsiteId || process.env.UMAMI_WEBSITE_ID || '';
-  return { hostUrl, websiteId, enabled: Boolean(hostUrl && websiteId) };
-}
-
-export function sanitizeUmamiEventData(data = {}) {
-  const output = {};
-  if (!data || typeof data !== 'object' || Array.isArray(data)) return output;
-  for (const [key, value] of Object.entries(data)) {
-    if (BLOCKED_KEYS.has(key)) continue;
-    if (value === undefined || value === null) continue;
-    if (typeof value === 'object') continue;
-    if (!ID_KEYS.has(key) && /email|name|content|html|markdown|body|prompt|token|cookie|auth|secret|password|key|file/i.test(key)) continue;
-    if (typeof value === 'string') {
-      if (value.length > 120) continue;
-      if (/@/.test(value)) continue;
-      output[key] = value;
-    } else if (typeof value === 'number' || typeof value === 'boolean') {
-      output[key] = value;
-    }
-  }
-  return output;
-}
-
-export function getUmamiHead(config = {}) {
-  const umami = getUmamiConfig(config);
-  if (!umami.enabled) return '';
-  const ctx = sanitizeUmamiEventData({
-    userId: config.userId,
-    orgId: config.orgId,
-    projectId: config.projectId,
-    projectSlug: config.projectSlug,
-    userRole: config.userRole,
-    buildId: config.buildId,
-    pageType: config.pageType,
-  });
-  return `<script defer src="${umami.hostUrl}/script.js" data-website-id="${umami.websiteId}"></script>
-<script>
-window.__DRAFTED_ANALYTICS__ = ${JSON.stringify(ctx)};
-window.draftedTrack = function(name, data) {
-  var base = window.__DRAFTED_ANALYTICS__ || {};
-  var payload = Object.assign({}, base, data || {});
-  if (window.umami && typeof window.umami.track === 'function') window.umami.track(name, payload);
-};
-window.addEventListener('load', function() {
-  var c = window.__DRAFTED_ANALYTICS__ || {};
-  if (c.userId && window.umami && typeof window.umami.identify === 'function') window.umami.identify(c.userId, { orgId: c.orgId, role: c.userRole });
-});
-</script>`;
-}
-
-export function getUmamiInteractionScript(pageType) {
-  return `<script>
-(function() {
-  function track(name, data) { if (window.draftedTrack) window.draftedTrack(name, Object.assign({ pageType: ${JSON.stringify(pageType)} }, data || {})); }
-  window.addEventListener('load', function() {
-    if (${JSON.stringify(pageType)} === 'surface') track('surface_loaded');
-  });
-  document.addEventListener('click', function(event) {
-    var el = event.target && event.target.closest && event.target.closest('a,button,[data-analytics-event],[data-template-slug],[data-project-id]');
-    if (!el) return;
-    var eventName = el.getAttribute('data-analytics-event');
-    if (eventName) return track(eventName, { action: el.getAttribute('data-analytics-action') || undefined });
-    var href = el.getAttribute('href') || '';
-    var cls = el.className || '';
-    if (el.matches('.nav-cta,.btn-primary,.btn-secondary')) track('cta_clicked', { action: href || (el.textContent || '').trim().slice(0, 40) });
-    if (el.getAttribute('data-template-slug')) track('template_selected', { templateSlug: el.getAttribute('data-template-slug') });
-    if (el.getAttribute('data-project-id')) track('project_navigated', { projectId: el.getAttribute('data-project-id') });
-    if (/share/i.test(String(cls)) || /share/i.test(el.textContent || '')) track('share_modal_action');
-    if (/sidebar/i.test(String(cls))) track('sidebar_used');
-    if (/tool|panel/i.test(String(cls))) track('tool_panel_used');
-  }, true);
-})();
-</script>`;
-}
-
-function getRequestUrl(req) {
-  if (!req) return undefined;
-  const host = typeof req.get === 'function' ? req.get('host') : req.headers?.host;
-  const protocol = req.protocol || 'https';
-  return host ? `${protocol}://${host}${req.originalUrl || req.url || ''}` : undefined;
-}
-
-export function trackUmamiEvent(name, data = {}, req = null) {
-  const umami = getUmamiConfig();
-  if (!umami.enabled || !name || name.length > 50) return;
-  // Account de-dupe: when the event carries a userId, send it as Umami's distinct id
-  // (`payload.id`). Umami then derives sessionId = uuid(websiteId, userId) with no IP/UA/date
-  // salt, so server-side events land in the SAME canonical session as the browser's
-  // umami.identify(userId) call — collapsing each account to one session across devices/time.
-  const distinctId = (typeof data.userId === 'string' && data.userId.length <= 64) ? data.userId : undefined;
-  const payload = {
-    type: 'event',
-    payload: {
-      website: umami.websiteId,
-      name,
-      ...(distinctId ? { id: distinctId } : {}),
-      url: getRequestUrl(req) || process.env.BASE_URL || 'https://drafted.live',
-      hostname: req?.hostname || 'drafted.live',
-      language: req?.headers?.['accept-language'],
-      referrer: req?.headers?.referer,
-      data: sanitizeUmamiEventData(data),
-    },
-  };
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 1500);
-  fetch(`${umami.hostUrl}/api/send`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'User-Agent': req?.headers?.['user-agent'] || 'Drafted Server Analytics',
-      // Not req.ip: with trust proxy it is the client-chosen leftmost XFF entry. This module
-      // ships in the npm package, so it cannot import the server's clientIp().
-      'X-Forwarded-For': req?.headers?.['cf-connecting-ip'] || req?.socket?.remoteAddress || '',
-    },
-    body: JSON.stringify(payload),
-    signal: controller.signal,
-  }).catch(() => {}).finally(() => clearTimeout(timeout));
-}

package/src/shared/anchor-scope.mjs

@@ -1,98 +0,0 @@
-/**
- * Anchored skills: which scope does an fs-style path address?
- *
- * Pure, no I/O. The root keyword is the separator (see folder-path.mjs), so the
- * folder chain and the gate surface both fall out of one split:
- *
- *   /o/acme/eng/backend/projects/api/designs/default/x.html
- *     -> surface 'projects', folder 'eng/backend', project 'api'
- *   /wiki/eng/foo        -> surface 'wiki',   folder ''    (the ORG wiki)
- *   /eng/wiki/foo        -> surface 'wiki',   folder 'eng' (the folder's wiki)
- *
- * Gate surfaces follow where the write lands: wiki -> wiki_pages, skills ->
- * skills, projects AND tasks -> designs rows ('projects'; a task is a frame).
- * A path that names no root (`/`, `/eng`) is a folder, not content: surface null.
- *
- * Id-addressed routes (layout, conflicts, designs/:id) cannot be classified
- * from a path; they resolve id -> project -> projects.folder and then call
- * buildScopeChain themselves.
- */
-import { ROOTS, folderPathError, normalizeFolder, splitFolderScope } from './folder-path.mjs';
-
-const SURFACE_OF_ROOT = { wiki: 'wiki', skills: 'skills', tasks: 'projects', projects: 'projects' };
-
-/**
- * @returns {{ org: string|null, folder: string, root: string|null, surface: 'projects'|'wiki'|'skills'|null,
- *             project: string|null, rest: string[], error?: string }}
- * `project` is the NAME in the path (null for tasks and bare `/projects`): the
- * caller resolves it to an id. `rest` is what follows the project (projects) or
- * the root (wiki/skills/tasks).
- */
-export function classifyPath(path) {
-  let segs = String(path || '').split('/').map((s) => s.trim()).filter(Boolean);
-  let org = null;
-  if (segs[0] === 'o' && segs.length >= 2) {
-    org = segs[1];
-    segs = segs.slice(2);
-  }
-  const { folder, rest } = splitFolderScope('/' + segs.join('/'));
-  const out = { org, folder: normalizeFolder(folder), root: null, surface: null, project: null, rest: [] };
-  if (out.folder) {
-    const bad = folderPathError(out.folder);
-    if (bad) return { ...out, error: bad };
-  }
-  if (!rest) return out;
-  const [root, ...tail] = rest.split('/').filter(Boolean);
-  out.root = root;
-  out.surface = SURFACE_OF_ROOT[root];
-  if (root === 'projects') {
-    out.project = tail[0] || null;
-    out.rest = tail.slice(1);
-  } else {
-    out.rest = tail;
-  }
-  return out;
-}
-
-/**
- * Both ends of a move. A `to` that names no root is relative to the source
- * (liftFolderScope does the same), so it gates the same scope. Identical
- * targets collapse to one; a cross-project move yields two.
- */
-export function classifyMove(from, to) {
-  const src = classifyPath(from);
-  const dstRaw = to == null ? null : classifyPath(to);
-  const dst = dstRaw && dstRaw.root ? dstRaw : null;
-  const targets = [src];
-  if (dst && !sameTarget(src, dst)) targets.push(dst);
-  return { from: src, to: dst, targets };
-}
-
-function sameTarget(a, b) {
-  return a.surface === b.surface && a.folder === b.folder && a.project === b.project;
-}
-
-/**
- * The scope chain a write at (folder, projectId) sits inside, outermost first:
- * org, each folder prefix, then the project. 'eng/backend' -> org, eng, eng/backend.
- *
- * @returns {Array<{scope:'org'|'folder'|'project', folder?:string, projectId?:string}>}
- */
-export function buildScopeChain({ folder = '', projectId = null } = {}) {
-  const chain = [{ scope: 'org', folder: '' }];
-  const segs = normalizeFolder(folder).split('/').filter(Boolean);
-  for (let i = 0; i < segs.length; i++) {
-    chain.push({ scope: 'folder', folder: segs.slice(0, i + 1).join('/') });
-  }
-  if (projectId) chain.push({ scope: 'project', projectId });
-  return chain;
-}
-
-/** Human/receipt form, stored in skill_gate_events.scope_chain. */
-export function formatScopeChain(chain) {
-  return (chain || [])
-    .map((n) => (n.scope === 'org' ? 'org' : n.scope === 'folder' ? n.folder : `project:${n.projectId}`))
-    .join(' > ');
-}
-
-export { ROOTS };

package/src/shared/excalidraw.mjs

@@ -1,94 +0,0 @@
-export const EXCALIDRAW_MIME = 'application/vnd.excalidraw+json';
-
-// Linear elements (arrow/line/freedraw) REQUIRE a `points` array — Excalidraw's scene
-// restore reads points.length and crashes ("Cannot read properties of undefined (reading
-// 'length')") → eternal "Loading scene" spinner. Hand-authored/agent-written scenes
-// routinely omit it (source: "https://excalidraw.com", ids like "el1"), so repair it
-// here: every read (serve) and write path funnels through normalizeExcalidrawScene, so
-// existing broken frames open and new bad writes are fixed before they land.
-const LINEAR_ELEMENT_TYPES = new Set(['arrow', 'line', 'freedraw']);
-
-function repairLinearElement(el) {
-  if (!LINEAR_ELEMENT_TYPES.has(el.type)) return el;
-  const pts = el.points;
-  const valid = Array.isArray(pts) && pts.length > 0 &&
-    pts.every((p) => Array.isArray(p) && p.length >= 2 && typeof p[0] === 'number' && typeof p[1] === 'number');
-  if (valid) return el;
-  const w = typeof el.width === 'number' && el.width > 0 ? el.width : 1;
-  const h = typeof el.height === 'number' && el.height > 0 ? el.height : 0;
-  return { ...el, points: [[0, 0], [w, h]] };
-}
-
-export function emptyExcalidrawScene() {
-  return {
-    type: 'excalidraw',
-    version: 2,
-    source: 'https://drafted.live',
-    elements: [],
-    appState: {},
-    files: {},
-  };
-}
-
-export function normalizeExcalidrawScene(input) {
-  const scene = typeof input === 'string' ? JSON.parse(input) : input;
-  if (!scene || typeof scene !== 'object' || Array.isArray(scene)) {
-    throw new Error('Excalidraw data must be an object');
-  }
-  if (!Array.isArray(scene.elements)) {
-    throw new Error('Excalidraw data must include elements array');
-  }
-  const appState = scene.appState && typeof scene.appState === 'object' && !Array.isArray(scene.appState)
-    ? scene.appState
-    : {};
-  const files = scene.files && typeof scene.files === 'object' && !Array.isArray(scene.files)
-    ? scene.files
-    : {};
-  return {
-    type: scene.type || 'excalidraw',
-    version: scene.version || 2,
-    source: scene.source || 'https://drafted.live',
-    elements: scene.elements.map(repairLinearElement).filter(Boolean),
-    appState,
-    files,
-  };
-}
-
-export function stringifyExcalidrawScene(input) {
-  return JSON.stringify(normalizeExcalidrawScene(input), null, 2);
-}
-
-// Element-level merge for surgical edits: shallow-merge `upserts` ONTO the
-// existing element with the same id (so a partial {id,x,y} moves it without
-// dropping its other props), and drop every id in `removeIds`. Existing element
-// order is preserved (z-order = array order); updated elements keep their
-// position. This is the accumulate/merge path that write_excalidraw (full
-// replace) is not — it lets a large scene be edited with a small payload
-// instead of resending the whole thing.
-//
-// An id that does NOT exist is an ERROR, not an append. The silent-append shape
-// shipped first and bit an agent: a typo'd/changed id added a partial
-// `{id,strokeStyle,…}` object with no type/x/y beside the untouched original, so
-// the render kept showing the old element and the write reported ok. Adding
-// elements is a full-scene job (write_excalidraw); edit is for existing ones.
-export function mergeExcalidrawElements(existing, upserts = [], removeIds = []) {
-  const scene = normalizeExcalidrawScene(existing);
-  const removeSet = new Set(Array.isArray(removeIds) ? removeIds : []);
-  const byId = new Map();
-  for (const el of scene.elements) {
-    if (!el || removeSet.has(el.id)) continue;
-    byId.set(el.id, el);
-  }
-  for (const el of (Array.isArray(upserts) ? upserts : [])) {
-    if (!el || typeof el !== 'object' || Array.isArray(el) || !el.id) {
-      throw new Error('Each element to upsert must be an object with an id');
-    }
-    if (removeSet.has(el.id)) continue;
-    const prev = byId.get(el.id);
-    if (!prev) {
-      throw new Error(`No element with id "${el.id}" in this scene — element-level edit updates existing elements; write the whole scene (write_excalidraw) to add or replace one.`);
-    }
-    byId.set(el.id, { ...prev, ...el });
-  }
-  return { ...scene, elements: Array.from(byId.values()) };
-}

package/src/shared/folder-path.mjs

@@ -1,176 +0,0 @@
-/**
- * Folder is the single recursive container: the org is that node at depth 0, and
- * EVERY folder level carries the same four roots (wiki, skills, tasks, projects).
- *
- *   /o/<org>/                      folder (depth 0)
- *     wiki/ skills/ tasks/ projects/
- *     engineering/                 folder
- *       wiki/ skills/ tasks/ projects/
- *
- * The grammar is unambiguous by construction: the ROOT KEYWORD IS THE SEPARATOR.
- * Everything before the first `wiki`/`skills`/`tasks`/`projects` segment is the
- * folder chain; everything after is the path within that root. So
- * `/wiki/engineering/foo` is the org wiki's nested page and
- * `/engineering/wiki/foo` is the `engineering` folder's — distinct strings, no
- * collision. The one constraint this imposes: the four names are RESERVED and a
- * folder may not take one.
- *
- * A folder is ADDRESSED, never remembered: the chain travels in the path (and
- * from there in a request-local `X-Drafted-Folder` header), so no shared row
- * carries a "current folder". A cursor here would be the retired
- * `sessions.org_id` mistake rebuilt one level down — see the Drafted wiki page
- * `engineering/org-addressing-model`.
- */
-
-export const ROOTS = ['wiki', 'skills', 'tasks', 'projects'];
-const RESERVED = new Set(ROOTS);
-
-export function isReservedFolderName(name) {
-  return RESERVED.has(String(name || '').trim().toLowerCase());
-}
-
-/** '' (org root) or 'a/b' — no leading/trailing slashes, no empty segments. */
-export function normalizeFolder(raw) {
-  return String(raw || '')
-    .split('/')
-    .map((s) => s.trim())
-    .filter(Boolean)
-    .join('/');
-}
-
-/** null when the folder path is usable, else the reason it is not. */
-export function folderPathError(raw) {
-  const segs = String(raw || '').split('/').map((s) => s.trim()).filter(Boolean);
-  if (!segs.length) return 'Folder name is required';
-  for (const s of segs) {
-    if (isReservedFolderName(s)) {
-      return `"${s}" is a reserved name — wiki, skills, tasks and projects are the four roots every folder carries, so a folder cannot be called one`;
-    }
-    if (s.length > 120) return `Folder name too long: "${s.slice(0, 40)}…"`;
-  }
-  return null;
-}
-
-/**
- * Split a path into its folder chain and the root-relative remainder.
- *
- *   /engineering/backend/wiki/foo → { folder: 'engineering/backend', rest: '/wiki/foo' }
- *   /wiki/engineering/foo         → { folder: '',                    rest: '/wiki/engineering/foo' }
- *   /engineering                  → { folder: 'engineering',         rest: '' }
- *   /                             → { folder: '',                    rest: '' }
- *
- * `rest` is '' when the path names a folder itself (no root keyword in it).
- */
-export function splitFolderScope(path) {
-  const segs = String(path || '').split('/').filter(Boolean);
-  const at = segs.findIndex((s) => RESERVED.has(s));
-  if (at === -1) return { folder: segs.join('/'), rest: '' };
-  return { folder: segs.slice(0, at).join('/'), rest: '/' + segs.slice(at).join('/') };
-}
-
-/** Re-join a folder chain and a root-relative path into one addressable path. */
-export function joinFolderScope(folder, rest) {
-  const f = normalizeFolder(folder);
-  const r = String(rest || '').replace(/^\/+/, '');
-  return '/' + [f, r].filter(Boolean).join('/');
-}
-
-/** The four roots as ls entries, for a folder at any depth (base = '/o/<org>[/<folder>]'). */
-export function rootEntries(base) {
-  const b = String(base || '').replace(/\/+$/, '');
-  const hints = {
-    wiki: 'knowledge pages (markdown, OKF)',
-    skills: 'reusable procedures (flat: one dir per skill slug)',
-    tasks: 'work items — a task is a frame; status/assignee are front matter on read',
-    projects: '<project>/<layer>/<lane>/<file>',
-  };
-  return ROOTS.map((name) => ({ name, type: 'directory', path: `${b}/${name}`, hint: hints[name] }));
-}
-
-/**
- * The folder lift for an fs call: pull the folder chain off the source path (and
- * off the destination, for mv), leaving root-relative paths the per-root
- * dispatch can use unchanged at any depth.
- *
- * A move stays within one folder — silently re-homing a page across folders on
- * a rename is the kind of quiet reorganisation that loses work.
- */
-export function liftFolderScope(path, to) {
-  const src = splitFolderScope(path);
-  const folder = src.folder;
-  if (folder) {
-    const bad = folderPathError(folder);
-    if (bad) return { error: bad };
-  }
-  const out = { folder, path: src.rest || path, rest: src.rest, to };
-  if (to) {
-    const dst = splitFolderScope(to);
-    if (dst.rest) {
-      if (normalizeFolder(dst.folder) !== normalizeFolder(folder)) {
-        return { error: `stays within one folder — source is /${folder || ''} and destination is /${dst.folder || ''}` };
-      }
-      out.to = dst.rest;
-    }
-  }
-  return out;
-}
-
-/**
- * The folders nested DIRECTLY inside `prefix` ('' = the org itself), given the
- * org's folder names (each of which is its full path). One segment deeper only —
- * `ls` shows a level, not a tree.
- */
-/** `repoOf(fullFolderName)` -> "slug@branch" when a repo is linked to that
- *  folder, else null.
- *
- *  SAY WHAT IS OWNED, NOT "THE FOLDER". A link makes the folder's WIKI and
- *  SKILLS git-owned — those answer 409 repo_owned on write. Its TASKS and
- *  PROJECTS are untouched and write normally (verified: a frame write into a
- *  project inside a linked folder succeeds). A bare "GIT-OWNED" on the folder
- *  overclaims, and an agent that believes it will not attempt a frame write it
- *  is perfectly entitled to make — a false negative costs more here than the
- *  409 it was meant to prevent. */
-export function subfolderEntries(base, prefix, names, repoOf = null) {
-  const depth = prefix ? normalizeFolder(prefix).split('/').length : 0;
-  const kids = new Set();
-  for (const raw of names || []) {
-    const name = normalizeFolder(raw);
-    if (!name) continue;
-    if (prefix && !name.startsWith(normalizeFolder(prefix) + '/')) continue;
-    const segs = name.split('/');
-    if (segs.length > depth) kids.add(segs[depth]);
-  }
-  const full = (name) => normalizeFolder([prefix, name].filter(Boolean).join('/'));
-  return [...kids].sort().map((name) => {
-    const repo = repoOf ? repoOf(full(name)) : null;
-    return {
-      name,
-      type: 'directory',
-      path: `${String(base || '').replace(/\/+$/, '')}/${name}`,
-      hint: repo
-        ? `folder — carries its own wiki, skills, tasks and projects · wiki + skills GIT-OWNED by ${repo} (edit those via commit); tasks + projects write normally`
-        : 'folder — carries its own wiki, skills, tasks and projects',
-    };
-  });
-}
-
-/**
- * Process surfaces: wiki pages agents WRITE through the tool rather than read.
- * Promote-to-commons appends to the wiki `log`, and a promotion that
- * contradicts canon is flagged in `review`.
- *
- * They must be excluded from the seed AND exempted from the repo_owned guard,
- * and those two must agree. Excluded but not exempted, they end up unauthorable
- * AND unwritten — the tool 409s a page git never received, and promote-to-commons
- * breaks with no obvious cause. Lives here because the CLI seeder and the server
- * guard both need it and drift between them is exactly the failure.
- *
- * Whole path segments only — `reference/log-shipping` is a normal page.
- */
-export const PROCESS_SURFACES = new Set(['log', 'review']);
-
-export function isProcessSurface(path) {
-  return String(path || '')
-    .split('/')
-    .some((seg) => PROCESS_SURFACES.has(seg));
-}