limn-review 0.1.147 → 0.1.149

package/dist/ai/budget.js

@@ -45,7 +45,7 @@
 //
 // One budget per ACCOUNT (= per machine), never per workspace.
 import { and, eq, gte, inArray } from 'drizzle-orm';
-import { AI_BUDGET_DAY_MS, AI_BUDGET_WEEK_MS, aiProviderWorthShowing, aiUsageView, budgetWindowStart, decideAiBudget, liveFiveHourReset, liveWeekReset, resolveAiBudgetSettings, rollingSpend, } from '../shared/index.js';
+import { AI_BUDGET_DAY_MS, AI_BUDGET_WEEK_MS, aiProviderWorthShowing, aiUsageView, budgetWindowStart, decideAiBudget, liveFiveHourReset, liveWeekReset, resolveAiBudgetSettings, budgetSettingsInForce, rollingSpend, } from '../shared/index.js';
 import { db, schema } from '../db/client.js';
 import { LOCAL_ACCOUNT_ID } from '../auth/account.js';
 import { getActiveProvider, getProvider } from './provider.js';
@@ -288,7 +288,10 @@ export async function aiBudgetSnapshot(accountId, opts = {}) {
     // the ledger — the named one (a manual run's per-run choice), else the default (active) one.
     const provider = opts.provider ? getProvider(opts.provider) : getActiveProvider();
     const route = provider.credentialRoute();
-    const { settings, isDefault } = await readAiBudgetSettings(accountId);
+    const stored = await readAiBudgetSettings(accountId);
+    const isDefault = stored.isDefault;
+    // On by default (a share of the week); a never-set row on an API key applies no US$ cap.
+    const settings = budgetSettingsInForce(stored.settings, isDefault, route);
     const probe = opts.probe ?? 'when_on';
     if (route === 'login' && (probe === 'always' || (probe === 'when_on' && settings.enabled)))
         kickUsageProbe(nowMs, provider);

package/dist/ai/effort.js

@@ -11,7 +11,9 @@
 // exactly the same runs as the Settings control (REVIEW_EFFORT IS the control, locked), so "Set by
 // REVIEW_EFFORT" under it is the whole story. Every other agent kind (CI review, ticket review,
 // diagrams, Check threads, chats, Resolve with Claude) runs at its provider's own fixed depth
-// (`defaultRunEffort`), which reads no environment.
+// (`defaultRunEffort`), which reads no environment — except Check against docs, whose read is pinned to
+// 'low' on both providers (review/story-docs/prompts.ts STORY_DOCS_EFFORT: the sections' text is in the
+// prompt, so it is reading, not search). Still a fixed depth; this setting does not reach it.
 //
 // A worktree run sends the level. A diff-only review runs ONE STEP LOWER, but never below what Default
 // runs it at — unless the chosen level is itself below that, when it runs at the chosen level

package/dist/ai/providers/claude.js

@@ -273,6 +273,82 @@ async function agentComplete(model, opts, credential) {
     }
     return { text: trimmed, usage: { inputTokens, outputTokens } };
 }
+// ---- describeImage (vision; docs/REFERENCE-DOCS.md § Figures) ------------------------------------
+//
+// The cheap completion's twin with ONE image beside the prompt: the same ladder, the same request shape
+// (low effort + thinking headroom on the adaptive model), no tools, one turn. On the login the image
+// rides a streamed user message (the Agent SDK's only way to send content blocks); on the key it is a
+// plain Messages API call.
+async function describeImage(req) {
+    const model = req.model ?? CLAUDE_MODEL_FOR_ROLE.fast;
+    const credential = resolveAiCredential();
+    const route = cheapRoute(credential);
+    if (route === 'none')
+        throw new Error(NO_CLAUDE_AUTH_MESSAGE);
+    const content = [
+        { type: 'image', source: { type: 'base64', media_type: req.image.mime, data: req.image.base64 } },
+        { type: 'text', text: req.prompt },
+    ];
+    const shape = cheapRequestShape(model, req.maxTokens ?? 400);
+    if (route === 'api' && credential.route === 'api_key') {
+        const { default: Anthropic } = await loadAnthropicSdk();
+        const client = new Anthropic({ apiKey: credential.apiKey });
+        const resp = await client.messages.create({
+            model,
+            max_tokens: shape.maxTokens,
+            ...(shape.effort ? { output_config: { effort: shape.effort } } : {}),
+            system: req.system,
+            messages: [{ role: 'user', content }],
+        });
+        const blocks = resp.content;
+        const text = (Array.isArray(blocks) ? blocks : [])
+            .map((b) => {
+            const block = b;
+            return block?.type === 'text' && typeof block.text === 'string' ? block.text : '';
+        })
+            .join('');
+        return { text: text.trim(), usage: { inputTokens: resp.usage.input_tokens, outputTokens: resp.usage.output_tokens }, model };
+    }
+    const { query } = await loadAgentSdk();
+    async function* oneMessage() {
+        yield { type: 'user', message: { role: 'user', content }, parent_tool_use_id: null, session_id: '' };
+    }
+    const q = query({
+        prompt: oneMessage(),
+        options: {
+            model,
+            ...(shape.effort ? { effort: shape.effort } : {}),
+            systemPrompt: req.system,
+            allowedTools: [],
+            maxTurns: 1,
+            permissionMode: 'bypassPermissions',
+            settingSources: [],
+            ...ISOLATED_MCP,
+            hooks: { PreToolUse: [ownToolsOnlyHook([])] },
+            ...claudeExecutableOptions(),
+            env: agentSdkEnv(process.env, credential),
+        },
+    });
+    let text = '';
+    let inputTokens = 0;
+    let outputTokens = 0;
+    for await (const message of q) {
+        if (message.type === 'assistant') {
+            const inner = (message.message ?? {});
+            for (const b of inner.content ?? [])
+                if (b?.type === 'text' && typeof b.text === 'string')
+                    text += b.text;
+        }
+        else if (message.type === 'result') {
+            const usage = (message.usage ?? {});
+            inputTokens = usage.input_tokens ?? inputTokens;
+            outputTokens = usage.output_tokens ?? outputTokens;
+        }
+    }
+    if (!text.trim())
+        throw new Error('The image description came back empty.');
+    return { text: text.trim(), usage: { inputTokens, outputTokens }, model };
+}
 // ---- detect ----------------------------------------------------------------------------------
 async function detect() {
     if (!config.aiEnabled) {
@@ -346,6 +422,7 @@ export const claudeProvider = {
     resolveModel,
     runAgent,
     complete,
+    describeImage,
     detect,
     credentialRoute: () => resolveAiCredential().route,
     usage: {

package/dist/api/plugins/rate-limit.js

@@ -116,11 +116,13 @@ function tierFor(method, path) {
     //                                                the customer's Jira with the saved token.
     //   GET /api/workspaces/:id/tracker/linear-check the Linear connection check — one call to
     //                                                Linear with the saved key.
-    // All three take the 60/min `search` bucket, the "one upstream call per request" tier. The plain
+    //   GET /api/workspaces/:id/tracker/notion-schema the Notion mapping read — the saved database's
+    //                                                schema (+ ≤ 3 related databases) with the saved token.
+    // All four take the 60/min `search` bucket, the "one upstream call per request" tier. The plain
     // `GET …/tracker` is DB-only and stays on `read` with the rest of the family.
     if (method === 'PUT' && /^\/api\/workspaces\/\d+\/tracker$/.test(path))
         return [TIERS.search, TIERS.read];
-    if (!mutating && /^\/api\/workspaces\/\d+\/tracker\/(jira-fields|linear-check)$/.test(path)) {
+    if (!mutating && /^\/api\/workspaces\/\d+\/tracker\/(jira-fields|linear-check|notion-schema)$/.test(path)) {
         return [TIERS.search, TIERS.read];
     }
     // SONARCLOUD (sonar/routes.ts): "Test connection" calls SonarCloud with the saved token (one call
@@ -128,6 +130,10 @@ function tierFor(method, path) {
     // `…/sonar` are DB-only and fall to `read` on the next line, decided rather than inherited.
     if (method === 'POST' && /^\/api\/workspaces\/\d+\/sonar\/check$/.test(path))
         return [TIERS.search, TIERS.read];
+    // WIKI CREDENTIALS (reference-docs/wiki/routes.ts): "Test connection" is one read of the customer's
+    // Confluence with the saved token → `search`. GET/PUT `…/wiki-credentials` are DB-only → `read` below.
+    if (method === 'POST' && /^\/api\/workspaces\/\d+\/wiki-credentials\/check$/.test(path))
+        return [TIERS.search, TIERS.read];
     // RUN AUTO REVIEWS NOW / RETRY (review/claude-review/auto-settings.ts): one press can queue up to a
     // day's cap of agentic model runs on the reader's own Claude or Codex — `ai` + `aiHourly`, decided
     // ABOVE the family's `read` line, by exact shape. The GET/PUT `…/auto-review` stay `read`.
@@ -420,6 +426,12 @@ function tierFor(method, path) {
     }
     if (method === 'POST' && /^\/api\/docs\/\d+\/rebuild$/.test(path))
         return [TIERS.ai, TIERS.aiHourly];
+    // WIKI SOURCES (reference-docs/wiki/routes.ts): adding a Confluence page and "Refresh now" read the
+    // CUSTOMER'S Confluence quota with the saved token (a page, its tree, a CQL search) and may run the
+    // build's model → search + ai + ai_hourly. (The credentials routes sit with the workspace family above.)
+    if (method === 'POST' && (path === '/api/docs/wiki' || /^\/api\/docs\/\d+\/refresh$/.test(path))) {
+        return [TIERS.search, TIERS.ai, TIERS.aiHourly];
+    }
     if (path === '/api/docs' || path.startsWith('/api/docs/'))
         return [TIERS.read];
     if (/^\/api\/workspaces\/\d+\/docs-settings$/.test(path))

package/dist/config.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
-import { migrateLegacyDataDir, resolveDataDir } from './data-dir.js';
+import { defaultDocsDir, migrateLegacyDataDir, resolveDataDir } from './data-dir.js';
 import { SPRINT_PATHS_BUDGET_USD_DEFAULT, SPRINT_PATHS_DAILY_CAP_DEFAULT, SPRINT_PATHS_MAX_TURNS_DEFAULT, } from './shared/index.js';
 // apps/backend as the base for relative paths regardless of cwd.
 const backendRoot = resolve(import.meta.dirname, '..');
@@ -53,6 +53,7 @@ if (!process.env.VITEST) {
 // GitHub rate limit and contend on the SQLite write lock. DATABASE_URL / --db
 // override this; a relative override resolves under apps/backend.
 const rawDbUrl = process.env.DATABASE_URL ?? './data/pierre-review.sqlite';
+const dbPath = isAbsolute(rawDbUrl) ? rawDbUrl : resolve(backendRoot, rawDbUrl);
 // ---- Phase 2 real-time sync: adaptive polling (see docs/REALTIME-SYNC.md) ----
 // DEFAULT ON. This is the PRIMARY sync strategy: cadence by activity bucket, plus a
 // conditional REST probe whose 304 costs no rate limit, so it's both fresher on active repos
@@ -136,7 +137,7 @@ export const config = {
     persistBodies: process.env.PERSIST_BODIES === 'true',
     port: intFromEnv('PORT', 4000),
     host: process.env.HOST ?? '127.0.0.1',
-    dbPath: isAbsolute(rawDbUrl) ? rawDbUrl : resolve(backendRoot, rawDbUrl),
+    dbPath,
     backfillDays: intFromEnv('BACKFILL_DAYS', 90),
     // First sync runs in two phases: a fast "foreground" window (matching the
     // default timeline range) so the board is usable in seconds, then the rest of
@@ -419,8 +420,13 @@ export const config = {
     sequenceDiagramDailyCap: intFromEnv('SEQUENCE_DIAGRAM_DAILY_CAP', 30),
     // ---- Reference docs (the per-workspace library — reference-docs/, docs/REFERENCE-DOCS.md) ----
     // Where the markdown tree lives: `<docsDir>/<accountId>/<workspaceId>/library/` (+ `sources/`).
-    // LIMN_DOCS_DIR overrides; default `<dataDir>/docs`.
-    docsDir: process.env.LIMN_DOCS_DIR ?? join(resolveDataDir(), 'docs'),
+    // LIMN_DOCS_DIR overrides. Default: ONE ROOT PER DATABASE (data-dir.ts `defaultDocsDir`) —
+    // `<dataDir>/docs` for the data directory's own DB, `<dataDir>/docs/db-<hash>` for any other.
+    docsDir: process.env.LIMN_DOCS_DIR?.trim() || defaultDocsDir(dbPath, resolveDataDir()),
+    // The root every database shared before the split: a DB with another root moves its own
+    // workspace folders out of it ONCE (reference-docs/owner.ts `migrateLegacyDocs`). Never when
+    // LIMN_DOCS_DIR is set — the user chose where the library lives.
+    legacyDocsDir: process.env.LIMN_DOCS_DIR?.trim() ? null : join(resolveDataDir(), 'docs'),
     // One Sonnet 5 build per document: its OWN spend and turn caps (a long PDF is read in 20-page
     // slices and written out section by section). Env only — no route sets them.
     docsBuildBudgetUsd: floatFromEnv('DOCS_BUILD_BUDGET_USD', 6),

package/dist/data-dir.js

@@ -30,6 +30,7 @@
 // user's history stranded. Instead the next boot simply tries the move again.
 //
 // No imports outside `node:*`, so cli.ts can load it before config.ts reads the environment.
+import { createHash } from 'node:crypto';
 import { existsSync, renameSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, join, relative, resolve } from 'node:path';
@@ -52,7 +53,27 @@ export function resolveDataDir(env = process.env, home = homedir()) {
     return target;
 }
 /** The database file the CLI and the server open by default (the name predates the rename). */
-const DB_FILE = 'pierre-review.sqlite';
+export const DB_FILE = 'pierre-review.sqlite';
+/**
+ * THE REFERENCE-DOCS ROOT FOR ONE DATABASE (when LIMN_DOCS_DIR is not set). ⚠ Two databases never
+ * share one: each one's boot janitor deletes every docs folder its own rows do not account for, so a
+ * shared root let a second backend (a worktree's `pnpm dev`, the installed CLI) wipe the first one's
+ * library (docs/REFERENCE-DOCS.md § On disk).
+ *
+ *   - The data directory's own database (`<dataDir>/pierre-review.sqlite`, the installed CLI's
+ *     default) keeps `<dataDir>/docs` — where every installed library already is; nothing moves.
+ *   - Any other database (`pnpm dev`'s `apps/backend/data/pierre-review.sqlite`, a `--db`, a
+ *     DATABASE_URL) gets `<dataDir>/docs/db-<12 hex of sha256(absolute DB path)>`. The `db-` prefix
+ *     keeps it non-numeric, so the default root's janitor — which only walks `<accountId>` folders,
+ *     in this version and every earlier one — never enters it.
+ */
+export function defaultDocsDir(dbPath, dataDir) {
+    const abs = resolve(dbPath);
+    const root = join(dataDir, 'docs');
+    if (abs === join(resolve(dataDir), DB_FILE))
+        return root;
+    return join(root, `db-${createHash('sha256').update(abs).digest('hex').slice(0, 12)}`);
+}
 function isInside(dir, path) {
     const rel = relative(dir, path);
     return rel === '' || (!!rel && !rel.startsWith('..') && !isAbsolute(rel));

package/dist/db/erase-account.js

@@ -162,6 +162,11 @@ export async function eraseAccountData(accountId) {
         // hostname AND the sealed API token. No FKs on the first two, so the explicit deletes are the
         // whole guarantee; workspace_trackers cascades from workspaces too, and is explicit anyway.
         await tx.delete(schema.trackerTickets).where(eq(schema.trackerTickets.accountId, accountId)).execute();
+        // The tickets' comments (migration 0141): people's words from the tracker. No FKs.
+        await tx
+            .delete(schema.trackerTicketComments)
+            .where(eq(schema.trackerTicketComments.accountId, accountId))
+            .execute();
         await tx.delete(schema.jiraAcFields).where(eq(schema.jiraAcFields.accountId, accountId)).execute();
         await tx.delete(schema.workspaceTrackers).where(eq(schema.workspaceTrackers.accountId, accountId)).execute();
         // SonarCloud (migration 0114 / pg 0101): the workspace rows hold the SEALED token; the snapshots
@@ -178,6 +183,12 @@ export async function eraseAccountData(accountId) {
         // person typed, answers they paid for). Both cascade from workspaces too, and are explicit anyway.
         // The FILES (the markdown tree and the stored uploads) are removed after the transaction below.
         await tx.delete(schema.referenceDocChatMessages).where(eq(schema.referenceDocChatMessages.accountId, accountId)).execute();
+        // Wiki sources (migration 0140): the page rows (before their documents — composite FK) and the
+        // sealed wiki credential. Both cascade too, and are explicit anyway.
+        await tx.delete(schema.referenceDocWikiPages).where(eq(schema.referenceDocWikiPages.accountId, accountId)).execute();
+        await tx.delete(schema.workspaceWikiCredentials).where(eq(schema.workspaceWikiCredentials.accountId, accountId)).execute();
+        // Figure descriptions (migration 0143): the account's image-description cache.
+        await tx.delete(schema.referenceDocFigureDescriptions).where(eq(schema.referenceDocFigureDescriptions.accountId, accountId)).execute();
         await tx.delete(schema.referenceDocs).where(eq(schema.referenceDocs.accountId, accountId)).execute();
         // Story docs checks (migration 0121 / pg 0108): cascade from workspaces too, and are explicit anyway.
         await tx.delete(schema.storyDocsAlignments).where(eq(schema.storyDocsAlignments.accountId, accountId)).execute();
@@ -328,6 +339,8 @@ export function accountScopedTables() {
         // The issue tracker (migration 0088 / pg 0075). All three carry their own accountId and are
         // erased explicitly above; `workspaceTrackers` holds a credential.
         { name: 'trackerTickets', col: schema.trackerTickets.accountId, table: schema.trackerTickets },
+        // Ticket comments (migration 0141), erased explicitly above.
+        { name: 'trackerTicketComments', col: schema.trackerTicketComments.accountId, table: schema.trackerTicketComments },
         { name: 'jiraAcFields', col: schema.jiraAcFields.accountId, table: schema.jiraAcFields },
         { name: 'workspaceTrackers', col: schema.workspaceTrackers.accountId, table: schema.workspaceTrackers },
         // SonarCloud (migration 0114 / pg 0101), erased explicitly above; `workspaceSonar` holds a credential.
@@ -344,6 +357,19 @@ export function accountScopedTables() {
             col: schema.referenceDocChatMessages.accountId,
             table: schema.referenceDocChatMessages,
         },
+        // Wiki sources (migration 0140), erased explicitly above; `workspaceWikiCredentials` holds a credential.
+        { name: 'referenceDocWikiPages', col: schema.referenceDocWikiPages.accountId, table: schema.referenceDocWikiPages },
+        // Figure descriptions (migration 0143), erased explicitly above.
+        {
+            name: 'referenceDocFigureDescriptions',
+            col: schema.referenceDocFigureDescriptions.accountId,
+            table: schema.referenceDocFigureDescriptions,
+        },
+        {
+            name: 'workspaceWikiCredentials',
+            col: schema.workspaceWikiCredentials.accountId,
+            table: schema.workspaceWikiCredentials,
+        },
         // Story docs checks (migration 0121 / pg 0108), erased explicitly above.
         { name: 'storyDocsAlignments', col: schema.storyDocsAlignments.accountId, table: schema.storyDocsAlignments },
         // Chronology's settings history (migration 0096 / pg 0083), erased explicitly above.

package/dist/db/export-account.js

@@ -84,6 +84,8 @@ export async function exportAccountData(accountId) {
         matchScope: schema.workspaceTrackers.matchScope,
         email: schema.workspaceTrackers.authEmail,
         hasToken: schema.workspaceTrackers.authToken,
+        // The Notion property mapping (not a secret).
+        notionConfig: schema.workspaceTrackers.notionConfig,
         updatedAt: schema.workspaceTrackers.updatedAt,
     })
         .from(schema.workspaceTrackers)
@@ -116,12 +118,48 @@ export async function exportAccountData(accountId) {
         summary: schema.referenceDocs.summary,
         topics: schema.referenceDocs.topics,
         sections: schema.referenceDocs.sections,
+        wiki: schema.referenceDocs.wiki,
         createdAt: schema.referenceDocs.createdAt,
         builtAt: schema.referenceDocs.builtAt,
     })
         .from(schema.referenceDocs)
         .where(eq(schema.referenceDocs.accountId, accountId))
         .execute();
+    // Wiki sources (migration 0140): the pages of each wiki document, and the wiki credential WITHOUT its token.
+    const wikiPageRows = await db
+        .select({
+        docId: schema.referenceDocWikiPages.docId,
+        pageId: schema.referenceDocWikiPages.pageId,
+        title: schema.referenceDocWikiPages.title,
+        version: schema.referenceDocWikiPages.version,
+        lastEditedAt: schema.referenceDocWikiPages.lastEditedAt,
+        lastFetchedAt: schema.referenceDocWikiPages.lastFetchedAt,
+    })
+        .from(schema.referenceDocWikiPages)
+        .where(eq(schema.referenceDocWikiPages.accountId, accountId))
+        .execute();
+    const wikiCredentialRows = await db
+        .select({
+        workspaceId: schema.workspaceWikiCredentials.workspaceId,
+        provider: schema.workspaceWikiCredentials.provider,
+        siteUrl: schema.workspaceWikiCredentials.siteUrl,
+        email: schema.workspaceWikiCredentials.authEmail,
+        hasToken: schema.workspaceWikiCredentials.authToken,
+        updatedAt: schema.workspaceWikiCredentials.updatedAt,
+    })
+        .from(schema.workspaceWikiCredentials)
+        .where(eq(schema.workspaceWikiCredentials.accountId, accountId))
+        .execute();
+    const figureRows = await db
+        .select({
+        imageHash: schema.referenceDocFigureDescriptions.imageHash,
+        description: schema.referenceDocFigureDescriptions.description,
+        model: schema.referenceDocFigureDescriptions.model,
+        createdAt: schema.referenceDocFigureDescriptions.createdAt,
+    })
+        .from(schema.referenceDocFigureDescriptions)
+        .where(eq(schema.referenceDocFigureDescriptions.accountId, accountId))
+        .execute();
     const docChatRows = await db
         .select({
         workspaceId: schema.referenceDocChatMessages.workspaceId,
@@ -275,6 +313,10 @@ export async function exportAccountData(accountId) {
         workspaceTrackers: trackerRows.map((t) => ({ ...t, hasToken: t.hasToken != null && t.hasToken !== '' })),
         workspaceSonar: sonarRows.map((t) => ({ ...t, hasToken: t.hasToken != null && t.hasToken !== '' })),
         referenceDocs: referenceDocRows,
+        referenceDocWikiPages: wikiPageRows,
+        // ⚠ PRESENCE ONLY — never the stored token, in any form.
+        workspaceWikiCredentials: wikiCredentialRows.map((t) => ({ ...t, hasToken: t.hasToken != null && t.hasToken !== '' })),
+        referenceDocFigureDescriptions: figureRows,
         repoRelations: repoRelationRows,
         sprintCodeJudgements: capped('sprintCodeJudgements', codeJudgementRows),
         referenceDocChatMessages: capped('referenceDocChatMessages', docChatRows),

package/dist/db/instance-id.js

@@ -0,0 +1,38 @@
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { db, schema } from './client.js';
+// THIS DATABASE'S ID (migration 0139, `instance_meta`). A random id written ONCE, the first time
+// anything asks, and read back from then on. It names the database FILE, not a path: the file can be
+// moved (the ~/.pierre-review → ~/.limn rename) and keeps its id; a second database on the same
+// machine (a worktree's dev server, the installed CLI) always has a different one. The reference-docs
+// janitor writes it into each workspace docs folder as `.owner` and never deletes a folder holding
+// another id (reference-docs/owner.ts).
+const KEY = 'instance_id';
+let cached = null;
+async function readOrCreate() {
+    const t = schema.instanceMeta;
+    const read = async () => {
+        const rows = await db.select({ value: t.value }).from(t).where(eq(t.key, KEY)).execute();
+        return rows[0]?.value ?? null;
+    };
+    const existing = await read();
+    if (existing)
+        return existing;
+    // Two first callers race to the insert; the loser's row is dropped and both read the winner's.
+    await db.insert(t).values({ key: KEY, value: randomUUID() }).onConflictDoNothing().execute();
+    const id = await read();
+    if (!id)
+        throw new Error('instance_meta: instance_id could not be written');
+    return id;
+}
+/** This database's random id (created on first call, cached for the process). */
+export function getInstanceId() {
+    if (!cached) {
+        cached = readOrCreate().catch((err) => {
+            cached = null;
+            throw err;
+        });
+    }
+    return cached;
+}
+//# sourceMappingURL=instance-id.js.map

package/dist/db/migrations/0139_instance_meta.sql

@@ -0,0 +1,8 @@
+-- THIS DATABASE'S OWN FACTS (key → value), not an account's. One row so far: `instance_id`, a random
+-- id written once (db/instance-id.ts) that names THIS database file wherever it is moved. The
+-- reference-docs janitor writes it into every workspace docs folder it creates (`.owner`) and never
+-- deletes a folder another database's id is written in (docs/REFERENCE-DOCS.md § On disk).
+CREATE TABLE `instance_meta` (
+	`key` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL
+);

package/dist/db/migrations/0140_reference_doc_wiki.sql

@@ -0,0 +1,62 @@
+-- WIKI SOURCES FOR THE REFERENCE LIBRARY (2026-10-28; docs/REFERENCE-DOCS.md § Wiki sources). CORE,
+-- free, LOCAL ONLY (agentic). A Confluence page tree becomes ONE document; a refresh re-reads only the
+-- changed pages and re-summarises only the changed sections. Self-contained and additive.
+--
+--   reference_docs.wiki_json            NEW, nullable JSON (ReferenceDocWikiState): the tree's root,
+--                                       depth and refresh state. NULL for every other source.
+--   reference_docs.summary_cache_json   NEW, nullable JSON (ReferenceDocSummaryCache): section hash →
+--                                       summary, so an unchanged section is never summarised again.
+--   reference_docs (id, account_id)     NEW unique index: the composite FK target below.
+--   workspaces.docs_used_at             NEW, nullable: the library was last used — the refresh's
+--                                       demand gate (7 days).
+--   reference_doc_wiki_pages            NEW: one row per page of a wiki document (version, hash, last
+--                                       fetch, last error). Composite FK onto the document; cascades.
+--   workspace_wiki_credentials          NEW: a sealed wiki credential per (workspace, provider).
+--                                       Composite FK onto the workspace; cascades.
+-- Both new tables carry account_id and join accountScopedTables() (erased, exported without the token).
+ALTER TABLE `reference_docs` ADD COLUMN `wiki_json` text;
+--> statement-breakpoint
+ALTER TABLE `reference_docs` ADD COLUMN `summary_cache_json` text;
+--> statement-breakpoint
+ALTER TABLE `workspaces` ADD COLUMN `docs_used_at` integer;
+--> statement-breakpoint
+CREATE UNIQUE INDEX `reference_docs_id_account` ON `reference_docs` (`id`,`account_id`);
+--> statement-breakpoint
+CREATE TABLE `reference_doc_wiki_pages` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`doc_id` integer NOT NULL,
+	`page_id` text NOT NULL,
+	`parent_page_id` text,
+	`depth` integer DEFAULT 0 NOT NULL,
+	`position` integer DEFAULT 0 NOT NULL,
+	`title` text NOT NULL,
+	`version` integer,
+	`last_edited_at` integer,
+	`content_hash` text,
+	`last_fetched_at` integer,
+	`last_error` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `reference_doc_wiki_pages_doc_account_fk` FOREIGN KEY (`doc_id`,`account_id`) REFERENCES `reference_docs`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `reference_doc_wiki_pages_doc_page` ON `reference_doc_wiki_pages` (`doc_id`,`page_id`);
+--> statement-breakpoint
+CREATE INDEX `reference_doc_wiki_pages_account_doc` ON `reference_doc_wiki_pages` (`account_id`,`doc_id`);
+--> statement-breakpoint
+CREATE TABLE `workspace_wiki_credentials` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`provider` text NOT NULL,
+	`site_url` text,
+	`auth_email` text,
+	`auth_token` text,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `workspace_wiki_credentials_workspace_account_fk` FOREIGN KEY (`workspace_id`,`account_id`) REFERENCES `workspaces`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `workspace_wiki_credentials_workspace_provider` ON `workspace_wiki_credentials` (`account_id`,`workspace_id`,`provider`);

package/dist/db/migrations/0141_tracker_ticket_comments.sql

@@ -0,0 +1,20 @@
+-- TICKET COMMENTS (docs/TRACKERS.md § Ticket comments). The discussion under a tracker ticket, one row
+-- per (account, provider, site, key, comment) — per TICKET, never per PR. The worker keeps the newest 20
+-- per ticket from the issue read it already makes; bots are stored with `is_bot` and never shown.
+CREATE TABLE `tracker_ticket_comments` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`provider` text NOT NULL,
+	`api_root` text NOT NULL,
+	`issue_key` text NOT NULL,
+	`comment_id` text NOT NULL,
+	`author_name` text DEFAULT '' NOT NULL,
+	`author_id` text,
+	`is_bot` integer DEFAULT false NOT NULL,
+	`body` text NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer,
+	`fetched_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `tracker_ticket_comments_ticket_comment` ON `tracker_ticket_comments` (`account_id`,`provider`,`api_root`,`issue_key`,`comment_id`);

package/dist/db/migrations/0142_ticket_review_comments_seen.sql

@@ -0,0 +1,4 @@
+-- What a ticket review run was given of the ticket's comments: {ids, count, hash} of the people's
+-- comments (docs/TRACKERS.md § Ticket comments). NOT part of the run's fingerprint: a new comment never
+-- makes a run stale; the state route counts the comments the run did not see.
+ALTER TABLE `ticket_reviews` ADD `comments_seen` text;

package/dist/db/migrations/0143_reference_doc_figures.sql

@@ -0,0 +1,25 @@
+-- FIGURES AS TEXT + NOTION SOURCES (2026-10-28; docs/REFERENCE-DOCS.md § Figures, § Wiki sources →
+-- Notion). CORE, free, LOCAL ONLY (agentic). Self-contained and additive. Notion needs no schema: its
+-- token is a `workspace_wiki_credentials` row with provider 'notion' (0140).
+--
+--   reference_docs.figures_json          NEW, nullable JSON (ReferenceDocFigures): the latest build's
+--                                        figures — described / outlined / kept / pending — and the one
+--                                        sentence when they could not be described here.
+--   reference_doc_figure_descriptions    NEW: the AI image-description CACHE, one row per (account,
+--                                        image sha256), so an unchanged image is never described again.
+-- The table carries account_id, joins accountScopedTables(), the erasure and the export.
+ALTER TABLE `reference_docs` ADD COLUMN `figures_json` text;
+--> statement-breakpoint
+CREATE TABLE `reference_doc_figure_descriptions` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`image_hash` text NOT NULL,
+	`description` text NOT NULL,
+	`provider` text,
+	`model` text,
+	`cost_usd` real,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `reference_doc_figure_descriptions_account_hash` ON `reference_doc_figure_descriptions` (`account_id`,`image_hash`);

package/dist/db/migrations/0144_workspace_tracker_notion.sql

@@ -0,0 +1,3 @@
+-- NOTION AS AN ISSUE TRACKER (docs/TRACKERS.md § Notion). The workspace's Notion property mapping
+-- (shared `NotionTrackerMapping`, JSON) beside the one tracker row it belongs to. Additive; NULL = none.
+ALTER TABLE `workspace_trackers` ADD `notion_config` text;

package/dist/db/migrations/0145_verdict_strictness.sql

@@ -0,0 +1,14 @@
+-- THE AUTO VERDICT'S TWO RULES + THE NOT-APPROVED REASON (docs/CLAUDE-REVIEW.md § Auto-posting →
+-- AUTO VERDICT). Both workspace columns are OVERRIDES ONLY: NULL = today's rule.
+-- `pair_verdict_strictness`: how a Claude + Codex pair's verdict is folded — NULL / 'strict' = approve
+-- only when both approved; 'relaxed' = approve when one approved and neither asked for changes.
+ALTER TABLE `workspaces` ADD `pair_verdict_strictness` text;
+--> statement-breakpoint
+-- `approve_leftovers`: which open findings may remain when Limn approves — NULL / 'nits_questions' =
+-- nits and questions; 'nits' = nits only; 'none' = nothing open at all.
+ALTER TABLE `workspaces` ADD `approve_leftovers` text;
+--> statement-breakpoint
+-- A REPLIES PASS's not-approved reason ({heldReason, text}), written when the pass ends while the
+-- workspace's auto verdict is on. NULL on every other row (a full review's reason is on its
+-- `auto_post` record, or computed on read).
+ALTER TABLE `claude_reviews` ADD `verdict_reason` text;

package/dist/db/migrations/meta/_journal.json

@@ -974,6 +974,55 @@
       "when": 1792137625016,
       "tag": "0138_team_claim_lines",
       "breakpoints": true
+    },
+    {
+      "idx": 139,
+      "version": "6",
+      "when": 1792137626016,
+      "tag": "0139_instance_meta",
+      "breakpoints": true
+    },
+    {
+      "idx": 140,
+      "version": "6",
+      "when": 1792137627016,
+      "tag": "0140_reference_doc_wiki",
+      "breakpoints": true
+    },
+    {
+      "idx": 141,
+      "version": "6",
+      "when": 1792137629016,
+      "tag": "0141_tracker_ticket_comments",
+      "breakpoints": true
+    },
+    {
+      "idx": 142,
+      "version": "6",
+      "when": 1792137630016,
+      "tag": "0142_ticket_review_comments_seen",
+      "breakpoints": true
+    },
+    {
+      "idx": 143,
+      "version": "6",
+      "when": 1792137632016,
+      "tag": "0143_reference_doc_figures",
+      "breakpoints": true
+    },
+    {
+      "idx": 144,
+      "version": "6",
+      "when": 1792137640016,
+      "tag": "0144_workspace_tracker_notion",
+      "breakpoints": true
+    },
+    {
+      "idx": 145,
+      "version": "6",
+      "when": 1792137641016,
+      "tag": "0145_verdict_strictness",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/queries.js

@@ -54,6 +54,7 @@ import { forwardKindOf, isConflicting, isRedCiStatus, RED_CI_STATUSES, } from '.
 import { authorAutomationFor, dependencyPrState, dependencyStateDetail, MERGE_QUEUE_CARD_DETAIL, securityFixDetail, unionAdvisoryIds, } from './dependency-cards.js';
 import { deriveSecurityAlerts } from './security-alerts.js';
 import { pruneTicketReviewsForPrs } from './ticket-review-prune.js';
+import { pruneOrphanTicketComments } from './ticket-comments-prune.js';
 import { pruneCiReviewsForPrs } from './ci-review-prune.js';
 import { pruneSequenceDiagramsForPrs } from './sequence-diagram-prune.js';
 import { failingChecksFields, prFailingChecks, trunkFailingChecks, trunkFailingFor, } from './failing-checks.js';
@@ -7872,6 +7873,8 @@ export async function deleteRepo(id, accountId) {
             // Stored tracker tickets (core since migration 0088 / pg 0075; the plugin used to prune them
             // per PR). No FKs, so nothing would cascade.
             await tx.delete(schema.trackerTickets).where(inArray(schema.trackerTickets.prId, prIds)).execute();
+            // Their tickets' comments (migration 0141), once no PR of this account names the ticket.
+            await pruneOrphanTicketComments(tx, [accountId]);
             // SonarCloud snapshots (migration 0114 / pg 0101). No FKs, so nothing would cascade.
             await tx.delete(schema.sonarSnapshots).where(inArray(schema.sonarSnapshots.prId, prIds)).execute();
             // The team-claim ledger (migration 0138). No FKs, so nothing would cascade. This machine's OPEN