@konneal/engine 0.2.179 → 0.2.182

package/dist/worker_public/src/index.js

@@ -4,16 +4,16 @@ import {
   handleMemories,
   scoreFaithfulness,
   scoreJudge
-} from "../../chunk-LDSGL62W.js";
+} from "../../chunk-YVQVT7GD.js";
 import "../../chunk-IRCDOFP4.js";
 import {
   TOOLS_REGISTRY,
   bindModelNode,
   modelGroundingBlock
-} from "../../chunk-ROXOL4GF.js";
+} from "../../chunk-VRWNS4AI.js";
 import {
   handleSearch
-} from "../../chunk-MUWO2EV6.js";
+} from "../../chunk-ZZGKC6WO.js";
 import {
   buildMessages,
   citations,
@@ -38,7 +38,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-CLDMP5YH.js";
+} from "../../chunk-4J47P52J.js";
 import {
   embed,
   generateOnce
@@ -76,8 +76,11 @@ import {
 } from "../../chunk-3FYJM7LH.js";
 import {
   cfBlobs,
+  cfModelRunner,
+  cfStore,
+  cfVectorIndex,
   portModelRunner
-} from "../../chunk-KINFFYQH.js";
+} from "../../chunk-YGQCVPX6.js";
 
 // workers/worker_public/src/conversations.ts
 var ID_RE = /^[a-zA-Z0-9_-]{8,64}$/;
@@ -197,6 +200,201 @@ async function handleAppendMessage(env, sub, req, convId) {
   return json({ id: mid }, 201);
 }
 
+// workers/worker_public/src/userDocuments.ts
+var USER_DOC_LIMIT = 10;
+var USER_DOC_MAX_BYTES = 20 * 1024 * 1024;
+var ACCEPTED_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp", "application/pdf"]);
+function userDocumentChunkId(docId) {
+  return `ud-${docId}`;
+}
+async function listUserDocuments(store, sub) {
+  const res = await store.prepare("SELECT id, owner_sub, name, kind, status, bytes, r2_key, fields, error, created_at, updated_at FROM user_documents WHERE owner_sub = ?1 ORDER BY created_at DESC").bind(sub).all();
+  return { documents: res.results ?? [] };
+}
+async function getUserDocument(store, sub, id) {
+  const row = await store.prepare("SELECT id, owner_sub, name, kind, status, bytes, r2_key, fields, error, created_at, updated_at FROM user_documents WHERE id = ?1 AND owner_sub = ?2").bind(id, sub).first();
+  return row ?? null;
+}
+async function quotaRefusal(store, sub) {
+  const row = await store.prepare("SELECT COUNT(*) AS n FROM user_documents WHERE owner_sub = ?1").bind(sub).first();
+  const n = Number(row?.n ?? 0);
+  if (n >= USER_DOC_LIMIT) {
+    return new Response(JSON.stringify({ error: { code: "quota_exceeded", message: `You hold the maximum of ${USER_DOC_LIMIT} documents. Delete one to import another.` } }), { status: 403, headers: { "content-type": "application/json" } });
+  }
+  return null;
+}
+async function createImport(ports, waitUntil, sub, file) {
+  const mime = file.type || "";
+  if (!ACCEPTED_MIMES.has(mime)) {
+    return { error: new Response(JSON.stringify({ error: { code: "invalid_type", message: "Upload a PNG, JPEG, WebP image or a PDF." } }), { status: 415, headers: { "content-type": "application/json" } }) };
+  }
+  if (file.size > USER_DOC_MAX_BYTES) {
+    return { error: new Response(JSON.stringify({ error: { code: "too_large", message: `Documents are limited to ${Math.floor(USER_DOC_MAX_BYTES / (1024 * 1024))} MB.` } }), { status: 413, headers: { "content-type": "application/json" } }) };
+  }
+  const refused = await quotaRefusal(ports.store, sub);
+  if (refused) return { error: refused };
+  const id = crypto.randomUUID();
+  const r2Key = `${sub}/${id}`;
+  const bytes = new Uint8Array(await file.arrayBuffer());
+  await ports.blobs.put(r2Key, bytes.buffer, mime);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const row = {
+    id,
+    owner_sub: sub,
+    name: file.name || "document",
+    kind: null,
+    status: "importing",
+    bytes: bytes.byteLength,
+    r2_key: r2Key,
+    fields: null,
+    error: null,
+    created_at: now,
+    updated_at: now
+  };
+  await ports.store.prepare(
+    "INSERT INTO user_documents (id, owner_sub, name, kind, status, bytes, r2_key, fields, error, created_at, updated_at) VALUES (?1,?2,?3,?4,?5,?6,?7,?8,?9,?10,?11)"
+  ).bind(id, sub, row.name, row.kind, row.status, row.bytes, row.r2_key, row.fields, row.error, now, now).run();
+  waitUntil(processImport(ports, row, mime, bytes).catch(() => {
+  }));
+  return { document: row };
+}
+async function processImport(ports, row, mime, bytes) {
+  const setStatus = async (status, fields, error) => {
+    await ports.store.prepare("UPDATE user_documents SET status = ?1, kind = ?2, fields = ?3, error = ?4, updated_at = ?5 WHERE id = ?6").bind(status, fields ? extractKind(fields) : null, fields ? JSON.stringify(fields) : null, error, (/* @__PURE__ */ new Date()).toISOString(), row.id).run();
+  };
+  try {
+    let text;
+    if (mime === "application/pdf") {
+      text = await pdfTextLayer(bytes);
+      if (!text || text.replace(/\s+/g, "").length < 40) {
+        await setStatus("no_text_layer", null, "This PDF has no extractable text layer. Export page images (PNG/JPEG) and import those \u2014 the vision lane reads them directly.");
+        return;
+      }
+    } else {
+      text = await visionTranscribe(ports.model, mime, bytes);
+      if (!text || text.replace(/\s+/g, "").length < 20) {
+        await setStatus("failed", null, "The vision lane could not read this image. Try a sharper photo.");
+        return;
+      }
+    }
+    const extraction = await structureDocument(ports.model, row.name, mime, text);
+    const fieldsLine = Object.entries(extraction.fields).map(([k, v]) => `${k}: ${v}`).join("; ");
+    const chunkText = `Member document (${extraction.kind}) \u2014 ${row.name}. ${fieldsLine}. ${extraction.summary}
+
+${extraction.text.slice(0, 8e3)}`;
+    const [vector] = await ports.model.embed([chunkText]);
+    await ports.lane.upsert([
+      {
+        id: userDocumentChunkId(row.id),
+        values: vector,
+        metadata: { user_sub: row.owner_sub, doc_id: row.id, kind: extraction.kind, name: row.name }
+      }
+    ]);
+    await setStatus("ready", { kind: extraction.kind, ...extraction.fields, summary: extraction.summary }, null);
+  } catch (e) {
+    await setStatus("failed", null, String(e).slice(0, 200)).catch(() => {
+    });
+  }
+}
+function extractKind(fields) {
+  return fields.kind || "other";
+}
+async function visionTranscribe(model, mime, bytes) {
+  let binary = "";
+  const CHUNK = 32768;
+  for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+  const dataUrl = `data:${mime};base64,${btoa(binary)}`;
+  const res = await model.run({
+    model: MODELS.member,
+    messages: [
+      { role: "system", content: "Transcribe everything you can read in this document image \u2014 certificate numbers, holders, models, values, dates, clause references. Transcribe first; organize nothing." },
+      { role: "user", content: [{ type: "image_url", image_url: { url: dataUrl } }] }
+    ],
+    maxTokens: 2048,
+    effort: "low",
+    temperature: 0.15
+  });
+  return res.text ?? "";
+}
+async function structureDocument(model, name, mime, text) {
+  const res = await model.run({
+    model: MODELS.member,
+    messages: [
+      { role: "system", content: `You classify and structure an imported metrology document. Answer with ONE JSON object: {"kind": "certificate"|"test_report"|"other", "fields": {\u2026short typed fields\u2026}, "summary": "one paragraph a retrieval engine can answer from"}. Certificates carry certificate numbers (like R60/2021-XX1-24.01), holders, models, issue dates. Test reports carry measured values, uncertainties, instruments, clause references. Fields use snake_case names, values verbatim from the text. Never invent a value the text does not carry.` },
+      { role: "user", content: `Document name: ${name}
+Format: ${mime}
+
+Text:
+${text.slice(0, 12e3)}` }
+    ],
+    maxTokens: 2048,
+    effort: "low",
+    temperature: 0.15
+  });
+  const raw = res.text ?? "";
+  const m = /\{[\s\S]*\}/.exec(raw);
+  if (!m) throw new Error("the structuring call returned no JSON object");
+  const parsed = JSON.parse(m[0]);
+  const fields = {};
+  for (const [k, v] of Object.entries(parsed.fields ?? {})) {
+    if (typeof v === "string" || typeof v === "number") fields[k.slice(0, 40)] = String(v).slice(0, 200);
+  }
+  const kind = parsed.kind === "certificate" || parsed.kind === "test_report" ? parsed.kind : "other";
+  return { kind, fields, summary: String(parsed.summary ?? "").slice(0, 1200), text };
+}
+async function pdfTextLayer(bytes) {
+  const raw = new TextDecoder("latin1").decode(bytes);
+  const parts = [];
+  const streamRe = /stream\r?\n?/g;
+  let m;
+  while (m = streamRe.exec(raw)) {
+    const start = m.index + m[0].length;
+    const end = raw.indexOf("endstream", start);
+    if (end < 0) break;
+    const chunk = raw.slice(start, end);
+    streamRe.lastIndex = end;
+    let content = "";
+    if (chunk.charCodeAt(0) === 120) {
+      try {
+        const ds = new DecompressionStream("deflate");
+        const stream = new Blob([new Uint8Array([...chunk].map((c) => c.charCodeAt(0) & 255))]).stream().pipeThrough(ds);
+        content = await new Response(stream).text();
+      } catch {
+        continue;
+      }
+    } else if (/\bTj\b|\bTJ\b/.test(chunk)) {
+      content = chunk;
+    } else {
+      continue;
+    }
+    parts.push(pdfTextOps(content));
+    if (parts.join("").length > 2e5) break;
+  }
+  return parts.join("\n");
+}
+function pdfTextOps(content) {
+  const out = [];
+  const re = /\((?:\\.|[^\\()])*\)/g;
+  let m;
+  while (m = re.exec(content)) {
+    let s = m[0].slice(1, -1);
+    s = s.replace(/\\([nrtbf()/\\])/g, (_, c) => ({ n: "\n", r: "", t: "	", b: "", f: "", "(": "(", ")": ")", "/": "/", "\\": "\\" })[c] ?? c);
+    s = s.replace(/\\([0-7]{1,3})/g, (_, o) => String.fromCharCode(parseInt(o, 8)));
+    if (s.trim()) out.push(s);
+  }
+  return out.join(" ");
+}
+async function deleteUserDocument(ports, sub, id) {
+  const row = await getUserDocument(ports.store, sub, id);
+  if (!row) return null;
+  if (row.r2_key) await ports.blobs.delete(row.r2_key).catch(() => {
+  });
+  await ports.lane.deleteIds([userDocumentChunkId(id)]).catch(() => {
+  });
+  await ports.store.prepare("DELETE FROM user_documents WHERE id = ?1 AND owner_sub = ?2").bind(id, sub).run();
+  return row;
+}
+
 // workers/worker_public/src/projects.ts
 var MAX_FILES = 10;
 var MAX_CONTENT = 8e3;
@@ -1175,13 +1373,13 @@ async function callToolOnce(env, ctx, _req, tier, key, name, args, t0) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const { runTool, TOOLS_REGISTRY: TOOLS_REGISTRY2 } = await import("../../tools-UCUNOJR4.js");
+    const { runTool, TOOLS_REGISTRY: TOOLS_REGISTRY2 } = await import("../../tools-HLA7O2ZK.js");
     let payload;
     if (TOOLS_REGISTRY2.some((t) => t.name === name && t.audiences.includes("mcp"))) {
       const r = await runTool({ ...env, DB: env.DB }, { name, args }, "mcp");
       payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
     } else {
-      const res = name === "ask" ? await (await import("../../ask-PWT4B6YE.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-KNPPTHMG.js")).handleSearch(env, ctx, inner, tier, key);
+      const res = name === "ask" ? await (await import("../../ask-YWYXQ6PE.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-N37WULEM.js")).handleSearch(env, ctx, inner, tier, key);
       payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), void 0, void 0, { durationMs: Date.now() - t0 });
@@ -1363,6 +1561,26 @@ var OPENAPI_SURFACE = [
     "pattern": "/api/memories/:id",
     "operationId": "deleteMemory"
   },
+  {
+    "method": "GET",
+    "pattern": "/api/user-documents",
+    "operationId": "listUserDocuments"
+  },
+  {
+    "method": "POST",
+    "pattern": "/api/user-documents",
+    "operationId": "createUserDocument"
+  },
+  {
+    "method": "GET",
+    "pattern": "/api/user-documents/:id",
+    "operationId": "getUserDocument"
+  },
+  {
+    "method": "DELETE",
+    "pattern": "/api/user-documents/:id",
+    "operationId": "deleteUserDocument"
+  },
   {
     "method": "GET",
     "pattern": "/api/projects",
@@ -1576,6 +1794,45 @@ async function memoriesRoute(c) {
   if (refused) return withCors(refused, corsHeaders(c.req));
   return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
+function userDocumentPorts(env) {
+  return { store: cfStore(env.DB), blobs: cfBlobs(env.USER_DOCS), lane: cfVectorIndex(env.USER_DOCS_INDEX), model: cfModelRunner(env.AI) };
+}
+async function userDocumentsRoute(c) {
+  const who = await opIdentity(c, "Sign in to manage your documents");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  if (c.req.method === "GET") {
+    const out = await listUserDocuments(userDocumentPorts(c.env).store, who.sub);
+    return withCors(json({ ...out, quota: { used: out.documents.length, limit: USER_DOC_LIMIT } }), corsHeaders(c.req));
+  }
+  if (c.req.method === "POST") {
+    const refused = opWriteRefused(c, who);
+    if (refused) return withCors(refused, corsHeaders(c.req));
+    const form = await c.req.formData().catch(() => null);
+    const file = form?.get("file");
+    if (!file || typeof file !== "object" || !("arrayBuffer" in file) || !("size" in file)) {
+      return err(400, "invalid_input", 'Upload a file in the multipart "file" field.');
+    }
+    const blob = file;
+    const out = await createImport(userDocumentPorts(c.env), c.ctx.waitUntil.bind(c.ctx), who.sub, blob);
+    if ("error" in out) return withCors(out.error, corsHeaders(c.req));
+    return withCors(json({ document: out.document }, 202), corsHeaders(c.req));
+  }
+  return err(405, "method_not_allowed", `The path is served, but not with ${c.req.method}`);
+}
+async function userDocumentItemRoute(c) {
+  const who = await opIdentity(c, "Sign in to manage your documents");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  if (c.req.method === "GET") {
+    const row = await getUserDocument(userDocumentPorts(c.env).store, who.sub, c.params.id);
+    if (!row) return err(404, "not_found", "No such document for this member");
+    return withCors(json({ document: row }), corsHeaders(c.req));
+  }
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  const gone = await deleteUserDocument(userDocumentPorts(c.env), who.sub, c.params.id);
+  if (!gone) return err(404, "not_found", "No such document for this member");
+  return withCors(json({ ok: true }), corsHeaders(c.req));
+}
 async function projectsRoute(c) {
   const who = await opIdentity(c, "Sign in to use projects");
   if (who instanceof Response) return withCors(who, corsHeaders(c.req));
@@ -1974,6 +2231,10 @@ var OPENAPI_HANDLERS = {
   getAttachment: attachmentsGetRoute,
   deleteAttachment: attachmentsDeleteRoute,
   listMemories: memoriesRoute,
+  listUserDocuments: userDocumentsRoute,
+  createUserDocument: userDocumentsRoute,
+  getUserDocument: userDocumentItemRoute,
+  deleteUserDocument: userDocumentItemRoute,
   createMemory: memoriesRoute,
   deleteMemory: memoriesRoute,
   listProjects: projectsRoute,

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.179",
+  "version": "0.2.182",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/migrations/0020_user_documents.sql

@@ -0,0 +1,18 @@
+-- The member's own documents (TODO.sota/20 v1): imported certificates
+-- and scanned reports, privately indexed in the user lane, answered
+-- beside the public corpus. 10 documents per member, 20 MB each, held
+-- until the member deletes; deletion is immediate and total.
+CREATE TABLE IF NOT EXISTS user_documents (
+    id TEXT PRIMARY KEY,
+    owner_sub TEXT NOT NULL,
+    name TEXT NOT NULL,
+    kind TEXT,
+    status TEXT NOT NULL,
+    bytes INTEGER NOT NULL,
+    r2_key TEXT,
+    fields TEXT,
+    error TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_user_documents_owner ON user_documents (owner_sub);

package/workers/worker_public/openapi.yaml

@@ -633,6 +633,78 @@ paths:
       responses:
         '200':
           description: The note is deleted.
+  /api/user-documents:
+    get:
+      tags: [UserDocuments]
+      summary: List the member's imported documents
+      operationId: listUserDocuments
+      responses:
+        '200':
+          description: The documents with their import status and the quota.
+    post:
+      tags: [UserDocuments]
+      summary: Import a document (a certificate or a test report)
+      description: >-
+        Member-gated. Upload one PNG/JPEG/WebP image or a PDF (20 MB
+        max, 10 documents held per member until deleted). The import
+        runs asynchronously: the route answers 202 with the importing
+        row, the status endpoint (or a re-list) tells the rest. Images
+        ride the vision lane; a PDF's text layer is extracted (a
+        scanned PDF with no text layer is answered honestly with the
+        no_text_layer status). Retention: held until the member
+        deletes; deletion is immediate and total.
+      operationId: createUserDocument
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required: [file]
+              properties:
+                file:
+                  type: string
+                  format: binary
+      responses:
+        '202':
+          description: The import is running; the row carries its status.
+        '413':
+          description: The document exceeds the 20 MB limit.
+        '415':
+          description: Unsupported media type.
+        '403':
+          description: The member holds the maximum of 10 documents.
+  /api/user-documents/{id}:
+    get:
+      tags: [UserDocuments]
+      summary: One imported document's status and extracted fields
+      operationId: getUserDocument
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200':
+          description: The document row.
+        '404':
+          description: No such document for this member.
+    delete:
+      tags: [UserDocuments]
+      summary: Delete an imported document
+      description: Immediate and total — the stored file, the private-lane vectors and the row go together.
+      operationId: deleteUserDocument
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200':
+          description: The document is deleted.
+        '404':
+          description: No such document for this member.
+
   /api/projects:
     get:
       tags: [Projects]

package/workers/worker_public/schema.sql

@@ -262,3 +262,19 @@ CREATE INDEX IF NOT EXISTS idx_attachments_sub ON attachments (sub);
 
 -- Tier-2 image reuse: the user message's stored attachment
 ALTER TABLE messages ADD COLUMN attachment_id TEXT;
+
+-- The member's own documents (TODO.sota/20 v1): the import lane.
+CREATE TABLE IF NOT EXISTS user_documents (
+    id TEXT PRIMARY KEY,
+    owner_sub TEXT NOT NULL,
+    name TEXT NOT NULL,
+    kind TEXT,
+    status TEXT NOT NULL,
+    bytes INTEGER NOT NULL,
+    r2_key TEXT,
+    fields TEXT,
+    error TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_user_documents_owner ON user_documents (owner_sub);

package/workers/worker_public/src/ask.ts

@@ -1722,20 +1722,23 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
           const tq = await chargeAnswerTokens(env, bucketId, stats, messageChars(messages!), full.length, probeTokensUsed);
           send({ type: "quota", quota: { ...quota, ...tq, credits: await creditBudget(env, bucketId), credit_estimate: creditPreview } });
           // the blind-answer guard ON THE STREAM PATH (the JSON path has
-          // had it since 0.2.80): an image rode the turn, the register
-          // note carries rows, and the streamed text is the no-information
-          // refusal — the multimodal call answered around the photograph.
-          // One bounded regeneration: the retry sentinel tells the client
-          // to clear the buffer, the agent step says why, and the fresh
-          // tokens stream as the answer.
-          if (withImage && register?.rows?.length && full.includes(refusalAnswer())) {
+          // had it since 0.2.80): the register note carries rows and the
+          // streamed text is the no-information refusal — the model
+          // answered around the register (originally the photograph's
+          // shape; since 0.2.179 the note rides every register-owned
+          // question, and the text-only lane refuses just the same —
+          // measured 2026-10-29: 11/14 standing probes with the note in
+          // the prompt). One bounded regeneration: the retry sentinel
+          // tells the client to clear the buffer, the agent step says
+          // why, and the fresh tokens stream as the answer.
+          if (register?.rows?.length && full.includes(refusalAnswer())) {
             console.log("blind-answer(stream): regenerating once");
             streamRestarts += 1;
             mark("Re-answering from the register results");
             send({ type: "retry" });
             const regen = await generateStream(env, model, [
               ...messages.slice(0, -1),
-              { role: "user", content: "The photograph was attached and the register note lists actual matching certificate rows. Present those rows — number, holder, model, status, and every document link — as the answer. Do not claim that nothing was provided." },
+              { role: "user", content: "The certificate register note above lists actual matching certificate rows. Present those rows — number, holder, model, status, and every document link — as the answer. Do not claim that nothing was provided." },
               messages[messages.length - 1],
             ], routeEffort(routed.route));
             if (regen) {
@@ -2084,12 +2087,12 @@ let convEntities: Array<{ entity: string; kind: string }> = [];
   // text claims nothing was provided — while the bridge succeeded and the
   // register note carries actual rows. One bounded regeneration, decided on
   // that exact signature; the retry carries a sterner ground instruction.
-  if (withImage && register?.rows?.length && answer!.includes(refusalAnswer())) {
+  if (register?.rows?.length && answer!.includes(refusalAnswer())) {
     console.log("blind-answer: the register note carried rows but the answer refused — regenerating once");
     mark("Re-answering from the register results");
     const regen = await generateOnce(env, model, [
       ...messages.slice(0, -1),
-      { role: "user", content: "The photograph was attached and the register note lists actual matching certificate rows. Present those rows — number, holder, model, status, and every document link — as the answer. Do not claim that nothing was provided." },
+      { role: "user", content: "The certificate register note above lists actual matching certificate rows. Present those rows — number, holder, model, status, and every document link — as the answer. Do not claim that nothing was provided." },
       messages[messages.length - 1],
     ], effort);
     if (regen && !regen!.includes(refusalAnswer())) {

package/workers/worker_public/src/env.ts

@@ -23,6 +23,8 @@ export interface Env {
   INDEX_VERSION: string;
   UNIT_ASSETS: R2Bucket;
   CHAT_UPLOADS: R2Bucket;
+  USER_DOCS: R2Bucket;
+  USER_DOCS_INDEX: any;
   ANON_DAY_ASK: string;
   ANON_DAY_SEARCH: string;
   KEY_DAY_ASK_DEFAULT: string;

package/workers/worker_public/src/index.ts

@@ -6,6 +6,7 @@ import { handleCallback, handleLogin, handleLogout, handleMe, sessionFrom } from
 import { opCfg, opMemberCanWrite, opTokenMember } from "./livedata";
 import { handleAppendMessage, handleConversations } from "./conversations";
 import { handleMemories } from "./memories";
+import { createImport, deleteUserDocument, getUserDocument, listUserDocuments, USER_DOC_LIMIT, type UserDocumentPorts } from "./userDocuments";
 import { handleProjects, handleProjectFiles } from "./projects";
 import { handleShareConversation, handleGetShared } from "./share";
 import { understandQuery } from "./understand";
@@ -26,7 +27,7 @@ import { handleSearch } from "./search";
 import { handleEnrich, handleSectionUnit, handleCaption, handleVisionJudge, handleVectors, handleJudge, handleCreateKey, handleListKeys, handleRevokeKey, handleKeyUsage, handleFamilySummary } from "./admin";
 import { handleResearch } from "./research";
 import { uploadAttachment, readAttachment, deleteAttachment, type AttachmentDeps } from "./attachments";
-import { cfBlobs } from "./ports/cloudflare/adapters";
+import { cfBlobs, cfStore, cfVectorIndex, cfModelRunner } from "./ports/cloudflare/adapters";
 import { handleAsk } from "./ask";
 import { handleMcp } from "./mcp";
 
@@ -127,6 +128,48 @@ async function memoriesRoute(c: RouteContext): Promise<Response> {
   return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
+function userDocumentPorts(env: Env): UserDocumentPorts {
+  return { store: cfStore(env.DB), blobs: cfBlobs(env.USER_DOCS), lane: cfVectorIndex(env.USER_DOCS_INDEX), model: cfModelRunner(env.AI) };
+}
+
+async function userDocumentsRoute(c: RouteContext): Promise<Response> {
+  const who = await opIdentity(c, "Sign in to manage your documents");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  if (c.req.method === "GET") {
+    const out = await listUserDocuments(userDocumentPorts(c.env).store, who.sub);
+    return withCors(json({ ...out, quota: { used: out.documents.length, limit: USER_DOC_LIMIT } }), corsHeaders(c.req));
+  }
+  if (c.req.method === "POST") {
+    const refused = opWriteRefused(c, who);
+    if (refused) return withCors(refused, corsHeaders(c.req));
+    const form = await c.req.formData().catch(() => null);
+    const file = form?.get("file") as unknown;
+    if (!file || typeof file !== "object" || !("arrayBuffer" in file) || !("size" in file)) {
+      return err(400, "invalid_input", "Upload a file in the multipart \"file\" field.");
+    }
+    const blob = file as { arrayBuffer(): Promise<ArrayBuffer>; size: number; type: string; name: string };
+    const out = await createImport(userDocumentPorts(c.env), c.ctx.waitUntil.bind(c.ctx), who.sub, blob);
+    if ("error" in out) return withCors(out.error, corsHeaders(c.req));
+    return withCors(json({ document: out.document }, 202), corsHeaders(c.req));
+  }
+  return err(405, "method_not_allowed", `The path is served, but not with ${c.req.method}`);
+}
+
+async function userDocumentItemRoute(c: RouteContext): Promise<Response> {
+  const who = await opIdentity(c, "Sign in to manage your documents");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  if (c.req.method === "GET") {
+    const row = await getUserDocument(userDocumentPorts(c.env).store, who.sub, c.params.id!);
+    if (!row) return err(404, "not_found", "No such document for this member");
+    return withCors(json({ document: row }), corsHeaders(c.req));
+  }
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  const gone = await deleteUserDocument(userDocumentPorts(c.env), who.sub, c.params.id!);
+  if (!gone) return err(404, "not_found", "No such document for this member");
+  return withCors(json({ ok: true }), corsHeaders(c.req));
+}
+
 async function projectsRoute(c: RouteContext): Promise<Response> {
   const who = await opIdentity(c, "Sign in to use projects");
   if (who instanceof Response) return withCors(who, corsHeaders(c.req));
@@ -619,6 +662,10 @@ const OPENAPI_HANDLERS: Record<OpenApiOperationId, RouteHandler> = {
   getAttachment: attachmentsGetRoute,
   deleteAttachment: attachmentsDeleteRoute,
   listMemories: memoriesRoute,
+  listUserDocuments: userDocumentsRoute,
+  createUserDocument: userDocumentsRoute,
+  getUserDocument: userDocumentItemRoute,
+  deleteUserDocument: userDocumentItemRoute,
   createMemory: memoriesRoute,
   deleteMemory: memoriesRoute,
   listProjects: projectsRoute,

package/workers/worker_public/src/openapi-surface.gen.ts

@@ -36,6 +36,10 @@ export type OpenApiOperationId =
   | "listMemories"
   | "createMemory"
   | "deleteMemory"
+  | "listUserDocuments"
+  | "createUserDocument"
+  | "getUserDocument"
+  | "deleteUserDocument"
   | "listProjects"
   | "createProject"
   | "deleteProject"
@@ -212,6 +216,26 @@ export const OPENAPI_SURFACE: readonly (Omit<OpenApiRoute, "operationId"> & { op
     "pattern": "/api/memories/:id",
     "operationId": "deleteMemory"
   },
+  {
+    "method": "GET",
+    "pattern": "/api/user-documents",
+    "operationId": "listUserDocuments"
+  },
+  {
+    "method": "POST",
+    "pattern": "/api/user-documents",
+    "operationId": "createUserDocument"
+  },
+  {
+    "method": "GET",
+    "pattern": "/api/user-documents/:id",
+    "operationId": "getUserDocument"
+  },
+  {
+    "method": "DELETE",
+    "pattern": "/api/user-documents/:id",
+    "operationId": "deleteUserDocument"
+  },
   {
     "method": "GET",
     "pattern": "/api/projects",

package/workers/worker_public/src/ports/cloudflare/adapters.ts

@@ -141,6 +141,9 @@ export function cfVectorIndex(index: unknown): VectorIndex {
       // the adapter law: batches above the provider cap go in chunks
       for (const group of by20(vectors)) await ix.upsert(group);
     },
+    async deleteIds(ids: string[]) {
+      for (const group of by20(ids)) await ix.deleteByIds(group);
+    },
     async getByIds(ids: string[]) {
       // getByIds above ~20 returns EMPTY silently — chunk, always
       const out: VectorMatch[] = [];

package/workers/worker_public/src/ports/vector.ts

@@ -23,4 +23,7 @@ export interface VectorIndex {
   query(q: VectorQuery): Promise<VectorMatch[]>;
   upsert(vectors: VectorUpsert[]): Promise<void>;
   getByIds(ids: string[]): Promise<VectorMatch[]>;
+  /** deletion rides the same chunk cap as reads — the provider's
+   *  deleteByIds is batch-shaped exactly like getByIds */
+  deleteIds(ids: string[]): Promise<void>;
 }