SharePointTransport (NEW — Microsoft Graph)

[llbbl]

The transport TeamWiki needs. Publish .docx to a SharePoint document library via Microsoft Graph.

Tasks

• App-only auth (client credentials), Sites.Selected least privilege.
• PUT /sites/{site-id}/drives/{drive-id}/root:/{path}/{name}.docx:/content; create-or-update by path; return the driveItem id.
• Store/return the id so republish updates the SAME file (preserves SharePoint version history).
• Tests with the Graph client mocked; scope + upload path asserted.

Acceptance: uploads/updates a .docx in a SharePoint library (mocked in tests); TeamWiki can consume it via the transport interface.

Depends on: "Transport interface + LocalFileTransport"

[llbbl]

Issue #4 execution bundle:

• task-1 - app-only Microsoft Graph auth using client credentials, with https://graph.microsoft.com/.default token scope and injectable test seams
• task-2 - SharePointTransport path mapping/segment encoding, Microsoft Graph simple-upload 250 MB guard, PUT create-or-update, stable driveItem result
• task-3 - mocked auth/Graph tests for least privilege configuration, exact URL/body/headers, repeat-upload identity, validation and failures; no live network
• task-4 - docs for consumer setup, Sites.Selected provisioning, path semantics, limits/errors
• task-5 - exact pnpm/multi-Node gates, independent review, PR

Notes:

• Sites.Selected is an admin-consented Microsoft Graph application permission. The app also needs a site-specific write grant provisioned out of band; it is not requested as the OAuth token scope.
• Client credentials should request https://graph.microsoft.com/.default.
• The simple PUT .../content upload path supports files up to 250 MB.
• Tests must stay fully mocked: no real tenant credentials and no live Microsoft Graph calls.

Reference docs:

• https://learn.microsoft.com/en-us/graph/auth-v2-service
• https://learn.microsoft.com/en-us/graph/permissions-reference#sitesselected
• https://learn.microsoft.com/en-us/graph/api/site-post-permissions?view=graph-rest-1.0
• https://learn.microsoft.com/en-us/graph/api/driveitem-put-content?view=graph-rest-1.0
• https://learn.microsoft.com/en-us/graph/onedrive-addressing-driveitems

[llbbl]

PR ready: #11 #11

All four issue work items are implemented and covered by the current test pass, including app-only auth, stable-path upload/replace semantics, and mocked Graph coverage for the TeamWiki-style consumer flow.

Non-blocking residuals intentionally left out of this issue: live tenant integration testing, retry/backoff behavior, and upload sessions for files larger than 250 MB.