feat(zettel): add tenant-safe topic endpoint

apps/zettel/src/index.test.ts

@@ -302,7 +302,22 @@ describe("Multi-tenant HTTP/WebSocket Integration Smoke Test", () => {
     expect(notesB1[0].title).toBe("About Oranges");
     expect(notesB1[0].body).toContain("Oranges are citrus");
 
-    // 8. Cleanup WebSockets
+    // 8. Topic pages search only the authenticated tenant's notes.
+    const wikiA = await fetch(`http://localhost:${port}/api/wiki/Apples`, {
+      headers: { cookie: cookieA },
+    });
+    expect(wikiA.status).toBe(200);
+    const wikiAData = await wikiA.json();
+    expect(wikiAData.markdown).toContain("About Apples");
+    expect(wikiAData.markdown).not.toContain("About Oranges");
+
+    const wikiB = await fetch(`http://localhost:${port}/api/wiki/Apples`, {
+      headers: { cookie: cookieB },
+    });
+    expect(wikiB.status).toBe(200);
+    expect((await wikiB.json()).markdown).toContain("No notes found");
+
+    // 9. Cleanup WebSockets
     wsA.close();
     wsB.close();
   });

apps/zettel/src/index.ts

@@ -27,6 +27,7 @@ import {
   deleteCustomTool,
   updateNote,
   deleteNote,
+  searchNotes,
 } from "./notes/store.js";
 
 dotenv.config();
@@ -238,6 +239,20 @@ const routes = api
       return c.json({ nodes: [], edges: [] });
     }
   })
+  .get("/wiki/:entity", async (c) => {
+    const user = c.get("user");
+    const entity = c.req.param("entity");
+    try {
+      const results = await searchNotes(user.id, entity, 50);
+      const sections = results.map(
+        (result) => `### [[${result.title}]]\n\n> ${result.snippet}`,
+      );
+      const related = sections.length > 0 ? sections.join("\n\n") : "No notes found mentioning this entity.";
+      return c.json({ markdown: `# ${entity}\n\n## Related Notes\n\n${related}\n` });
+    } catch (err: unknown) {
+      return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+    }
+  })
   .post("/transcribe", async (c) => {
     const user = c.get("user");
     try {