nlm-memory 0.21.0 → 0.21.13

package/dist/core/storage/supersedence-log.d.ts

@@ -4,10 +4,13 @@
  * supersedence at ingest time is not logged here — that lineage is already
  * implicit in the session_edges row's predecessor reference.
  *
- * Path defaults to ~/.nlm/supersedence-log.jsonl, overridable via
- * NLM_SUPERSEDENCE_LOG. Telemetry path — never raises, but on failure it
- * emits one warning line to stderr so a silent disk-full or permission
- * issue doesn't leave the operator believing their audit trail is intact.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/supersedence-log.jsonl, overridable via
+ * NLM_SUPERSEDENCE_LOG; every other tenant is isolated under
+ * ~/.nlm/tenants/<tenantId>/supersedence-log.jsonl and ignores the env
+ * override. Telemetry path — never raises, but on failure it emits one
+ * warning line to stderr so a silent disk-full or permission issue doesn't
+ * leave the operator believing their audit trail is intact.
  */
 export interface SupersedenceEntry {
     readonly predecessorId: string;
@@ -16,7 +19,7 @@ export interface SupersedenceEntry {
     readonly source?: string;
 }
 /** Read all supersedence log entries. Never raises — returns [] on missing file. */
-export declare function readSupersedenceLog(): Promise<ReadonlyArray<SupersedenceEntry & {
+export declare function readSupersedenceLog(tenantId: string, logPath?: string): Promise<ReadonlyArray<SupersedenceEntry & {
     ts: string;
     source?: string;
 }>>;
@@ -27,5 +30,5 @@ export interface FactSupersedenceEntry {
 }
 /** Append a fact-level supersedence event to the shared audit JSONL.
  *  Entries carry `kind: "fact"` so the session-scoped reader skips them. */
-export declare function appendFactSupersedence(entry: FactSupersedenceEntry, logPath?: string): Promise<void>;
-export declare function appendSupersedence(entry: SupersedenceEntry, logPath?: string): Promise<void>;
+export declare function appendFactSupersedence(tenantId: string, entry: FactSupersedenceEntry, logPath?: string): Promise<void>;
+export declare function appendSupersedence(tenantId: string, entry: SupersedenceEntry, logPath?: string): Promise<void>;

package/dist/core/storage/supersedence-log.js

@@ -4,24 +4,29 @@
  * supersedence at ingest time is not logged here — that lineage is already
  * implicit in the session_edges row's predecessor reference.
  *
- * Path defaults to ~/.nlm/supersedence-log.jsonl, overridable via
- * NLM_SUPERSEDENCE_LOG. Telemetry path — never raises, but on failure it
- * emits one warning line to stderr so a silent disk-full or permission
- * issue doesn't leave the operator believing their audit trail is intact.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/supersedence-log.jsonl, overridable via
+ * NLM_SUPERSEDENCE_LOG; every other tenant is isolated under
+ * ~/.nlm/tenants/<tenantId>/supersedence-log.jsonl and ignores the env
+ * override. Telemetry path — never raises, but on failure it emits one
+ * warning line to stderr so a silent disk-full or permission issue doesn't
+ * leave the operator believing their audit trail is intact.
  */
 import { appendFile, mkdir, readFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-function defaultLogPath() {
-    return (process.env["NLM_SUPERSEDENCE_LOG"] ??
-        join(homedir(), ".nlm", "supersedence-log.jsonl"));
+import { dirname } from "node:path";
+import { tenantStatePath } from "../tenancy/tenant-state-path.js";
+import { DEFAULT_TEAM_ID } from "../tenancy/default-team.js";
+function defaultLogPath(tenantId) {
+    if (tenantId === DEFAULT_TEAM_ID) {
+        return process.env["NLM_SUPERSEDENCE_LOG"] ?? tenantStatePath(tenantId, "supersedence-log.jsonl");
+    }
+    return tenantStatePath(tenantId, "supersedence-log.jsonl");
 }
 /** Read all supersedence log entries. Never raises — returns [] on missing file. */
-export async function readSupersedenceLog() {
-    const path = defaultLogPath();
+export async function readSupersedenceLog(tenantId, logPath = defaultLogPath(tenantId)) {
     let raw;
     try {
-        raw = await readFile(path, "utf8");
+        raw = await readFile(logPath, "utf8");
     }
     catch {
         // Log file missing or unreadable - no supersedence history recovered.
@@ -53,7 +58,7 @@ export async function readSupersedenceLog() {
 }
 /** Append a fact-level supersedence event to the shared audit JSONL.
  *  Entries carry `kind: "fact"` so the session-scoped reader skips them. */
-export async function appendFactSupersedence(entry, logPath = defaultLogPath()) {
+export async function appendFactSupersedence(tenantId, entry, logPath = defaultLogPath(tenantId)) {
     try {
         await mkdir(dirname(logPath), { recursive: true });
         const payload = {
@@ -70,7 +75,7 @@ export async function appendFactSupersedence(entry, logPath = defaultLogPath())
         process.stderr.write(`nlm-memory: failed to append fact-supersedence-log entry at ${logPath}: ${msg}\n`);
     }
 }
-export async function appendSupersedence(entry, logPath = defaultLogPath()) {
+export async function appendSupersedence(tenantId, entry, logPath = defaultLogPath(tenantId)) {
     try {
         await mkdir(dirname(logPath), { recursive: true });
         const payload = {

package/dist/core/storage/supersedence-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"supersedence-log.js","sourceRoot":"","sources":["../../../src/core/storage/supersedence-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AASlC,SAAS,cAAc;IACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAGvC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACxD,IACE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBACzC,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAEvC,SAAS;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBACpC,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;gBAChC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAClD,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA4B,EAC5B,UAAkB,cAAc,EAAE;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,OAAO,KAAK,GAAG,IAAI,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,UAAkB,cAAc,EAAE;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,OAAO,KAAK,GAAG,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"supersedence-log.js","sourceRoot":"","sources":["../../../src/core/storage/supersedence-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAShE,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAI1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACxD,IACE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBACzC,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAEvC,SAAS;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBACpC,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;gBAChC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAClD,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,KAA4B,EAC5B,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,OAAO,KAAK,GAAG,IAAI,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,KAAwB,EACxB,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,OAAO,KAAK,GAAG,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/tenancy/default-team.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The fixed id of the single-tenant local deployment's team, seeded by
+ * migrations 034 (both lanes). A literal — never generated — so it can appear
+ * in sqlite column DEFAULTs (tenancy design doc, kept privately in .superpowers/).
+ */
+export declare const DEFAULT_TEAM_ID = "team_local";

package/dist/core/tenancy/default-team.js

@@ -0,0 +1,7 @@
+/**
+ * The fixed id of the single-tenant local deployment's team, seeded by
+ * migrations 034 (both lanes). A literal — never generated — so it can appear
+ * in sqlite column DEFAULTs (tenancy design doc, kept privately in .superpowers/).
+ */
+export const DEFAULT_TEAM_ID = "team_local";
+//# sourceMappingURL=default-team.js.map

package/dist/core/tenancy/default-team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-team.js","sourceRoot":"","sources":["../../../src/core/tenancy/default-team.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC"}

package/dist/core/tenancy/hosted-mode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * NLM_HOSTED=1 switches the daemon to hosted posture. Under hosted mode,
+ * LOCAL-dispositioned routes (whole-DB dataset/backup/restore/stats,
+ * process-global classifier swap) and M6-FILTER routes (citation events,
+ * recall/facts stats+recent, hook-memo trio — file-state surfaces not yet
+ * tenant-attributed) return 403 before touching any handler (program spec
+ * §4.6). Local mode (the default, no env set) is unaffected.
+ */
+export declare function isHostedMode(): boolean;

package/dist/core/tenancy/hosted-mode.js

@@ -0,0 +1,12 @@
+/**
+ * NLM_HOSTED=1 switches the daemon to hosted posture. Under hosted mode,
+ * LOCAL-dispositioned routes (whole-DB dataset/backup/restore/stats,
+ * process-global classifier swap) and M6-FILTER routes (citation events,
+ * recall/facts stats+recent, hook-memo trio — file-state surfaces not yet
+ * tenant-attributed) return 403 before touching any handler (program spec
+ * §4.6). Local mode (the default, no env set) is unaffected.
+ */
+export function isHostedMode() {
+    return process.env["NLM_HOSTED"] === "1";
+}
+//# sourceMappingURL=hosted-mode.js.map

package/dist/core/tenancy/hosted-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-mode.js","sourceRoot":"","sources":["../../../src/core/tenancy/hosted-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC;AAC3C,CAAC"}

package/dist/core/tenancy/team-auth.d.ts

@@ -0,0 +1,16 @@
+/**
+ * resolveTeamByToken — the one auth-only tenant-resolution function every
+ * gated network transport routes through (program spec §3: "The tenant is
+ * resolved from the authenticated credential and from nothing else").
+ *
+ * Mechanism: sha256-hex the presented bearer token, look up
+ * `team_tokens WHERE token_hash = $hash AND revoked_at IS NULL`, return the
+ * team_id. No ambient derivation, no request parameter, no fallback chain —
+ * a token that doesn't resolve returns null and the caller denies.
+ */
+import type { TeamTokenStorePort } from "./team-token-store.js";
+export interface ResolvedTeam {
+    readonly teamId: string;
+}
+export declare function hashTeamToken(token: string): string;
+export declare function resolveTeamByToken(store: TeamTokenStorePort, presentedToken: string | undefined | null): Promise<ResolvedTeam | null>;

package/dist/core/tenancy/team-auth.js

@@ -0,0 +1,22 @@
+/**
+ * resolveTeamByToken — the one auth-only tenant-resolution function every
+ * gated network transport routes through (program spec §3: "The tenant is
+ * resolved from the authenticated credential and from nothing else").
+ *
+ * Mechanism: sha256-hex the presented bearer token, look up
+ * `team_tokens WHERE token_hash = $hash AND revoked_at IS NULL`, return the
+ * team_id. No ambient derivation, no request parameter, no fallback chain —
+ * a token that doesn't resolve returns null and the caller denies.
+ */
+import { createHash } from "node:crypto";
+export function hashTeamToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+export async function resolveTeamByToken(store, presentedToken) {
+    if (!presentedToken)
+        return null;
+    const hash = hashTeamToken(presentedToken);
+    const row = await store.findActiveByHash(hash);
+    return row ? { teamId: row.teamId } : null;
+}
+//# sourceMappingURL=team-auth.js.map

package/dist/core/tenancy/team-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-auth.js","sourceRoot":"","sources":["../../../src/core/tenancy/team-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/core/tenancy/team-token-store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * TeamTokenStore / PgTeamTokenStore — CRUD over the `team_tokens` table
+ * (program spec §2 M1, §3 M3). This IS the tenancy registry, not corpus
+ * data: methods take no `tenantId` param by design, same pinned exception as
+ * SourceRegistry.findByToken (src/core/sources/source-registry.ts) — the
+ * whole point of this store is to RESOLVE a tenant from a presented token,
+ * not to be scoped by one. team_tokens is TENANT-NEUTRAL and exempt from the
+ * tenantClause guard (tests/integration/tenant-guard.test.ts) for the same
+ * reason findByToken is exempt.
+ */
+import type Database from "better-sqlite3";
+import type { Pool } from "pg";
+export interface ResolvedTeamToken {
+    readonly teamId: string;
+}
+export interface TeamTokenStorePort {
+    /** AUTH lookup: resolves an active (non-revoked) token hash to its team. */
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    /**
+     * Idempotent insert-if-absent. Used for local-mode boot continuity (M3
+     * §3): an existing NLM_MCP_TOKEN's hash is seeded once for the default
+     * team so it keeps authenticating through the same resolveTeamByToken
+     * path as any future per-team token. A no-op if the hash already has a
+     * row (active OR revoked) — never resurrects a deliberately revoked token.
+     */
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}
+export declare class TeamTokenStore implements TeamTokenStorePort {
+    private readonly db;
+    constructor(db: Database.Database);
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}
+export declare class PgTeamTokenStore implements TeamTokenStorePort {
+    private readonly pool;
+    constructor(pool: Pool);
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}

package/dist/core/tenancy/team-token-store.js

@@ -0,0 +1,52 @@
+/**
+ * TeamTokenStore / PgTeamTokenStore — CRUD over the `team_tokens` table
+ * (program spec §2 M1, §3 M3). This IS the tenancy registry, not corpus
+ * data: methods take no `tenantId` param by design, same pinned exception as
+ * SourceRegistry.findByToken (src/core/sources/source-registry.ts) — the
+ * whole point of this store is to RESOLVE a tenant from a presented token,
+ * not to be scoped by one. team_tokens is TENANT-NEUTRAL and exempt from the
+ * tenantClause guard (tests/integration/tenant-guard.test.ts) for the same
+ * reason findByToken is exempt.
+ */
+export class TeamTokenStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async findActiveByHash(hash) {
+        const row = this.db.prepare("SELECT team_id FROM team_tokens WHERE token_hash = ? AND revoked_at IS NULL").get(hash);
+        return row ? { teamId: row.team_id } : null;
+    }
+    async insert(hash, teamId) {
+        this.db.prepare("INSERT INTO team_tokens (token_hash, team_id) VALUES (?, ?)").run(hash, teamId);
+    }
+    async revoke(hash) {
+        this.db.prepare("UPDATE team_tokens SET revoked_at = datetime('now') WHERE token_hash = ?").run(hash);
+    }
+    async ensureActive(hash, teamId) {
+        const existing = this.db.prepare("SELECT token_hash FROM team_tokens WHERE token_hash = ?").get(hash);
+        if (existing)
+            return;
+        await this.insert(hash, teamId);
+    }
+}
+export class PgTeamTokenStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async findActiveByHash(hash) {
+        const result = await this.pool.query("SELECT team_id FROM team_tokens WHERE token_hash = $1 AND revoked_at IS NULL", [hash]);
+        return result.rows[0] ? { teamId: result.rows[0].team_id } : null;
+    }
+    async insert(hash, teamId) {
+        await this.pool.query("INSERT INTO team_tokens (token_hash, team_id) VALUES ($1, $2)", [hash, teamId]);
+    }
+    async revoke(hash) {
+        await this.pool.query("UPDATE team_tokens SET revoked_at = NOW() WHERE token_hash = $1", [hash]);
+    }
+    async ensureActive(hash, teamId) {
+        await this.pool.query("INSERT INTO team_tokens (token_hash, team_id) VALUES ($1, $2) ON CONFLICT (token_hash) DO NOTHING", [hash, teamId]);
+    }
+}
+//# sourceMappingURL=team-token-store.js.map

package/dist/core/tenancy/team-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-token-store.js","sourceRoot":"","sources":["../../../src/core/tenancy/team-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA4BH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6EAA6E,CAC9E,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAc;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,6DAA6D,CAC9D,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,0EAA0E,CAC3E,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B,yDAAyD,CAC1D,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAc;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,+DAA+D,EAC/D,CAAC,IAAI,EAAE,MAAM,CAAC,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,mGAAmG,EACnG,CAAC,IAAI,EAAE,MAAM,CAAC,CACf,CAAC;IACJ,CAAC;CACF"}

package/dist/core/tenancy/tenant-clause.d.ts

@@ -0,0 +1,37 @@
+/**
+ * tenantClause / tenantClausePg — the single WHERE-fragment builder every
+ * corpus SQL string routes through (program spec §4.2). Wave C's guard test
+ * (tests/integration/tenant-guard.test.ts) scans src/core/storage/*.ts,
+ * actions-log.ts, build-dataset.ts, and http/app.ts for the literal text
+ * `tenant_id =`; the invariant this file exists to hold is that the literal
+ * appears ONLY here (migrations excepted).
+ *
+ * Two entry points because the two backends bind params differently, and
+ * both existing store idioms build a WHERE clause the same way — a
+ * `where: string[]` of fragments joined with " AND ", pushed alongside a
+ * parallel `params: unknown[]` array (see SqliteFactStore.list / .listBySessions,
+ * PgFactStore.list) — so a helper that returns one `{sql, param}` pair slots
+ * directly into that pattern for both:
+ *
+ *   sqlite (better-sqlite3, positional `?`):
+ *     const c = tenantClause(tenantId);
+ *     where.push(c.sql); params.push(c.param);
+ *
+ *   pg (node-postgres, numbered `$n`, tracked via a running `idx`):
+ *     const c = tenantClausePg(tenantId, idx++);
+ *     where.push(c.sql); params.push(c.param);
+ *
+ * For single-fragment templates (SqliteSessionStore.getById et al., built as
+ * a fixed template literal rather than a where[]/params[] pair), the fragment
+ * still composes: interpolate `c.sql` at the right spot in the template and
+ * append `c.param` to the positional argument list in the matching order.
+ *
+ * `column` defaults to the bare column name but accepts an alias-qualified
+ * form (e.g. "s.tenant_id") for joined queries.
+ */
+export interface TenantClause {
+    readonly sql: string;
+    readonly param: string;
+}
+export declare function tenantClause(tenantId: string, column?: string): TenantClause;
+export declare function tenantClausePg(tenantId: string, paramIndex: number, column?: string): TenantClause;

package/dist/core/tenancy/tenant-clause.js

@@ -0,0 +1,11 @@
+export function tenantClause(tenantId, column = "tenant_id") {
+    if (!tenantId)
+        throw new Error("tenantClause: tenantId is required");
+    return { sql: `${column} = ?`, param: tenantId };
+}
+export function tenantClausePg(tenantId, paramIndex, column = "tenant_id") {
+    if (!tenantId)
+        throw new Error("tenantClausePg: tenantId is required");
+    return { sql: `${column} = $${paramIndex}`, param: tenantId };
+}
+//# sourceMappingURL=tenant-clause.js.map

package/dist/core/tenancy/tenant-clause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-clause.js","sourceRoot":"","sources":["../../../src/core/tenancy/tenant-clause.ts"],"names":[],"mappings":"AAoCA,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAM,GAAG,WAAW;IACjE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAM,GAAG,WAAW;IACvF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/core/tenancy/tenant-state-path.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Path derivation for the shared file-state modules (hook memo, hook log,
+ * query/citation/miss logs — the JSONL/JSON telemetry that predates
+ * per-tenant SQLite rows). The default team's paths are byte-identical to
+ * the pre-M6 layout (~/.nlm/<segments>); every other tenant is isolated
+ * under ~/.nlm/tenants/<sanitized-tenantId>/<same segments>, so file state
+ * stops leaking across tenants the way a shared ~/.nlm/query_log.jsonl did.
+ *
+ * Sanitization mirrors the conversation-id rule in core/hook/memo.ts
+ * ([^A-Za-z0-9_-] -> "_", with "unknown" as the fallback for an id that
+ * sanitizes to nothing) but is not injective on its own — "acme.co" and
+ * "acme_co" both sanitize to "acme_co", which would collide the two
+ * tenants' directories. An id already safe (matches [A-Za-z0-9_-]+) is used
+ * as-is; any other id gets the sanitized form plus an 8-hex-char sha256
+ * digest of the *raw* (pre-sanitization) id appended, so two ids that
+ * collide after sanitization always land in distinct directories.
+ *
+ * NLM_STATE_ROOT overrides the ~/.nlm base directory for every tenant,
+ * default team included (the two branches below share the same `base`).
+ * This is a root move, not a per-tenant redirect: it does not reintroduce
+ * the leak the per-file overrides (NLM_QUERY_LOG et al., which apply to the
+ * default team's file only) were scoped away from — every tenant's
+ * directory keeps moving together under the new root, so isolation between
+ * tenants is unaffected. Test-only; production leaves it unset.
+ */
+export declare const TENANTS_DIRNAME = "tenants";
+/** ~/.nlm/<segments> for the default team; ~/.nlm/tenants/<t>/<segments> otherwise. */
+export declare function tenantStatePath(tenantId: string, ...segments: string[]): string;

package/dist/core/tenancy/tenant-state-path.js

@@ -0,0 +1,49 @@
+/**
+ * Path derivation for the shared file-state modules (hook memo, hook log,
+ * query/citation/miss logs — the JSONL/JSON telemetry that predates
+ * per-tenant SQLite rows). The default team's paths are byte-identical to
+ * the pre-M6 layout (~/.nlm/<segments>); every other tenant is isolated
+ * under ~/.nlm/tenants/<sanitized-tenantId>/<same segments>, so file state
+ * stops leaking across tenants the way a shared ~/.nlm/query_log.jsonl did.
+ *
+ * Sanitization mirrors the conversation-id rule in core/hook/memo.ts
+ * ([^A-Za-z0-9_-] -> "_", with "unknown" as the fallback for an id that
+ * sanitizes to nothing) but is not injective on its own — "acme.co" and
+ * "acme_co" both sanitize to "acme_co", which would collide the two
+ * tenants' directories. An id already safe (matches [A-Za-z0-9_-]+) is used
+ * as-is; any other id gets the sanitized form plus an 8-hex-char sha256
+ * digest of the *raw* (pre-sanitization) id appended, so two ids that
+ * collide after sanitization always land in distinct directories.
+ *
+ * NLM_STATE_ROOT overrides the ~/.nlm base directory for every tenant,
+ * default team included (the two branches below share the same `base`).
+ * This is a root move, not a per-tenant redirect: it does not reintroduce
+ * the leak the per-file overrides (NLM_QUERY_LOG et al., which apply to the
+ * default team's file only) were scoped away from — every tenant's
+ * directory keeps moving together under the new root, so isolation between
+ * tenants is unaffected. Test-only; production leaves it unset.
+ */
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DEFAULT_TEAM_ID } from "./default-team.js";
+export const TENANTS_DIRNAME = "tenants";
+const SAFE_TENANT_ID = /^[A-Za-z0-9_-]+$/;
+function sanitizeTenantId(tenantId) {
+    if (SAFE_TENANT_ID.test(tenantId))
+        return tenantId;
+    const sanitized = tenantId.replace(/[^A-Za-z0-9_-]/g, "_") || "unknown";
+    const hash = createHash("sha256").update(tenantId).digest("hex").slice(0, 8);
+    return `${sanitized}_${hash}`;
+}
+function stateRoot() {
+    return process.env["NLM_STATE_ROOT"] || join(homedir(), ".nlm");
+}
+/** ~/.nlm/<segments> for the default team; ~/.nlm/tenants/<t>/<segments> otherwise. */
+export function tenantStatePath(tenantId, ...segments) {
+    const base = stateRoot();
+    if (tenantId === DEFAULT_TEAM_ID)
+        return join(base, ...segments);
+    return join(base, TENANTS_DIRNAME, sanitizeTenantId(tenantId), ...segments);
+}
+//# sourceMappingURL=tenant-state-path.js.map

package/dist/core/tenancy/tenant-state-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-state-path.js","sourceRoot":"","sources":["../../../src/core/tenancy/tenant-state-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,GAAG,QAAkB;IACrE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9E,CAAC"}

package/dist/core/wiki/project.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The projection: select, roll up, render, reconcile.
+ *
+ * Reads current content through the writer so reconcile can skip unchanged
+ * files. Colliding spellings of one subject merge into a single page rather
+ * than throwing (see slug.ts); only a slug that collides with a reserved
+ * generated filename still propagates, because the alternative there is one
+ * page silently overwriting the index or log.
+ */
+import type { FactStore } from "../../ports/fact-store.js";
+import type { WikiWriter } from "../../ports/wiki-writer.js";
+import type { ProjectionResult, WikiConfig } from "./types.js";
+export interface ProjectDeps {
+    readonly facts: Pick<FactStore, "listSubjectStats" | "listBySubjects">;
+    readonly writer: WikiWriter;
+}
+export declare function projectWiki(deps: ProjectDeps, tenantId: string, config: WikiConfig, today: string): Promise<ProjectionResult>;

package/dist/core/wiki/project.js

@@ -0,0 +1,37 @@
+import { buildSlugGroups } from "./slug.js";
+import { selectSubjects } from "./select.js";
+import { rollupPages } from "./rollup.js";
+import { renderAll } from "./render.js";
+import { planReconcile } from "./reconcile.js";
+export async function projectWiki(deps, tenantId, config, today) {
+    const stats = await deps.facts.listSubjectStats(tenantId);
+    const selected = selectSubjects(stats, config);
+    const groups = buildSlugGroups(selected.map((s) => s.subject));
+    const pages = await rollupPages(deps, tenantId, selected, groups);
+    const rendered = renderAll(pages, config, today);
+    const existing = await deps.writer.list();
+    const rendering = new Set(rendered.map((r) => r.relPath));
+    const current = new Map();
+    for (const relPath of existing) {
+        if (!rendering.has(relPath))
+            continue;
+        const content = await deps.writer.read(relPath);
+        if (content !== null)
+            current.set(relPath, content);
+    }
+    const plan = planReconcile(rendered, existing, current);
+    for (const file of plan.toWrite)
+        await deps.writer.write(file.relPath, file.content);
+    for (const relPath of plan.toRemove)
+        await deps.writer.remove(relPath);
+    const onDisk = (await deps.writer.list()).filter((p) => p !== "index.md" && p !== "log.md").length;
+    return {
+        written: plan.toWrite.length,
+        unchanged: plan.unchanged,
+        removed: plan.toRemove.length,
+        qualifying: pages.length,
+        onDisk,
+        coverageDrift: pages.length - onDisk,
+    };
+}
+//# sourceMappingURL=project.js.map

package/dist/core/wiki/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/core/wiki/project.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAO/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAiB,EACjB,QAAgB,EAChB,MAAkB,EAClB,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACnG,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC7B,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,MAAM;QACN,aAAa,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM;KACrC,CAAC;AACJ,CAAC"}

package/dist/core/wiki/reconcile.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Diff the rendered set against what is on disk.
+ *
+ * Skipping byte-identical files is what makes a 6-hourly job free: a run with
+ * no corpus change writes nothing and Obsidian never re-indexes. Removing
+ * files with no rendered counterpart is what keeps the tree a projection
+ * rather than an append-only pile.
+ */
+import type { RenderedPage } from "./types.js";
+export interface ReconcilePlan {
+    readonly toWrite: ReadonlyArray<RenderedPage>;
+    readonly toRemove: ReadonlyArray<string>;
+    readonly unchanged: number;
+}
+export declare function planReconcile(rendered: ReadonlyArray<RenderedPage>, existing: ReadonlyArray<string>, current: ReadonlyMap<string, string>): ReconcilePlan;

package/dist/core/wiki/reconcile.js

@@ -0,0 +1,14 @@
+export function planReconcile(rendered, existing, current) {
+    const toWrite = [];
+    let unchanged = 0;
+    for (const file of rendered) {
+        if (current.get(file.relPath) === file.content)
+            unchanged += 1;
+        else
+            toWrite.push(file);
+    }
+    const keep = new Set(rendered.map((f) => f.relPath));
+    const toRemove = existing.filter((p) => !keep.has(p));
+    return { toWrite, toRemove, unchanged };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/core/wiki/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../../../src/core/wiki/reconcile.ts"],"names":[],"mappings":"AAgBA,MAAM,UAAU,aAAa,CAC3B,QAAqC,EACrC,QAA+B,EAC/B,OAAoC;IAEpC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS,IAAI,CAAC,CAAC;;YAC1D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC"}

package/dist/core/wiki/render.d.ts

@@ -0,0 +1,5 @@
+import type { PageRollup, RenderedPage, WikiConfig } from "./types.js";
+export declare function renderPage(page: PageRollup, config: WikiConfig): RenderedPage;
+export declare function renderIndex(pages: ReadonlyArray<PageRollup>, today: string): RenderedPage;
+export declare function renderLog(pages: ReadonlyArray<PageRollup>, today: string): RenderedPage;
+export declare function renderAll(pages: ReadonlyArray<PageRollup>, config: WikiConfig, today: string): ReadonlyArray<RenderedPage>;