@noodleseed/one 0.121.0 → 0.123.0

package/node_modules/@noodle-borg/knowledge-operations/dist/dispatch.js

@@ -0,0 +1,41 @@
+import { sendJson } from './http.js';
+import { parseKnowledgePath } from './paths.js';
+import { handleKnowledgeDocumentUpload, handleKnowledgePreflight, } from './routes.js';
+import { handleKnowledgeList, handleKnowledgeStatus } from './status-routes.js';
+export function dispatchKnowledgeRequest(req, res, url, deps) {
+    const ref = parseKnowledgePath(url.pathname);
+    if (ref === undefined)
+        return false;
+    const method = ref.kind === 'preflight' ? 'POST' : ref.kind === 'document' ? 'PUT' : 'GET';
+    if (method !== req.method)
+        return false;
+    const statusDeps = deps.routeDeps.status;
+    if ((ref.kind === 'list' || ref.kind === 'status') && statusDeps === undefined) {
+        return false;
+    }
+    deps.applySecurityHeaders(res);
+    if (deps.enforceHttps(req, res))
+        return true;
+    (async () => {
+        const identity = await deps.authorize(req, res, ref.tenant.org);
+        if (identity === false)
+            return;
+        if (ref.kind === 'preflight') {
+            await handleKnowledgePreflight(req, res, ref.tenant, deps.routeDeps);
+        }
+        else if (ref.kind === 'document') {
+            await handleKnowledgeDocumentUpload(req, res, ref.tenant, ref.sha256, deps.routeDeps);
+        }
+        else if (statusDeps !== undefined && ref.kind === 'list') {
+            await handleKnowledgeList(req, res, ref.tenant, statusDeps);
+        }
+        else if (statusDeps !== undefined && ref.kind === 'status') {
+            await handleKnowledgeStatus(req, res, ref.tenant, ref.component, statusDeps);
+        }
+    })().catch(() => {
+        if (!res.headersSent)
+            sendJson(res, 500, { error: 'internal error' });
+    });
+    return true;
+}
+//# sourceMappingURL=dispatch.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAehF,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAA2B;IAE3B,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,CAAC,KAAK,IAAI,EAAE;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO;QAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3D,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACd,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/executor.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Runtime `search_<name>` execution (ADR 0202 as amended): feature gate → bundled BM25 for
+ * documents → budget-gated managed site search → deterministic RRF fusion with the exact
+ * origin/path policy postfilter. Budget exhaustion on a mixed component is a typed error —
+ * blocked, never silently degraded to document-only. Document-only components never touch
+ * the budget (file search is bundled and costs nothing).
+ */
+import { type SearchBudgetCeilings, type SearchBudgetStore, type SearchHit, type SiteSearch } from '@noodle-borg/knowledge';
+import type { KnowledgeDeployHooks } from './publication.js';
+import { type KnowledgeTenantRef } from './routes.js';
+/** The component facts the executor needs; a structural subset of the compiled component. */
+export interface KnowledgeSearchComponent {
+    readonly name: string;
+    readonly sites: readonly {
+        readonly origin: string;
+        readonly include: readonly string[];
+    }[];
+}
+export interface KnowledgeSearchRequest {
+    readonly query: string;
+    readonly limit?: number;
+}
+export interface KnowledgeSearchExecutor {
+    enabled(tenant: KnowledgeTenantRef): Promise<boolean>;
+    /** Throws `KnowledgeError` or `SearchBudgetExhaustedError`; never returns partial truth. */
+    search(tenant: KnowledgeTenantRef, component: KnowledgeSearchComponent, request: KnowledgeSearchRequest): Promise<readonly SearchHit[]>;
+}
+export interface KnowledgeSearchExecutorDeps {
+    readonly hooks: KnowledgeDeployHooks;
+    readonly knowledgeEnabled: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    /** Site-search spend control; absent means site search is unavailable (documents still serve). */
+    readonly budget?: {
+        readonly store: SearchBudgetStore;
+        readonly ceilings: (tenant: KnowledgeTenantRef) => Promise<SearchBudgetCeilings>;
+    };
+    /** Managed live-site adapter bound per tenant; absent until the managed project is configured. */
+    readonly siteSearchFor?: (tenant: KnowledgeTenantRef) => SiteSearch;
+}
+export declare function createKnowledgeSearchExecutor(deps: KnowledgeSearchExecutorDeps): KnowledgeSearchExecutor;
+//# sourceMappingURL=executor.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAQL,KAAK,oBAAoB,EAEzB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,aAAa,CAAC;AAE9E,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CAC7F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,4FAA4F;IAC5F,MAAM,CACJ,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,wBAAwB,EACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;KAClF,CAAC;IACF,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,UAAU,CAAC;CACrE;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,2BAA2B,GAChC,uBAAuB,CA8DzB"}

package/node_modules/@noodle-borg/knowledge-operations/dist/executor.js

@@ -0,0 +1,54 @@
+/**
+ * Runtime `search_<name>` execution (ADR 0202 as amended): feature gate → bundled BM25 for
+ * documents → budget-gated managed site search → deterministic RRF fusion with the exact
+ * origin/path policy postfilter. Budget exhaustion on a mixed component is a typed error —
+ * blocked, never silently degraded to document-only. Document-only components never touch
+ * the budget (file search is bundled and costs nothing).
+ */
+import { DEFAULT_RESULT_LIMIT, fuseHits, KnowledgeError, MAX_QUERY_CHARS, MAX_RESULT_LIMIT, MIN_QUERY_CHARS, MIN_RESULT_LIMIT, SearchBudgetExhaustedError, } from '@noodle-borg/knowledge';
+import { knowledgeEnableCommand } from './routes.js';
+export function createKnowledgeSearchExecutor(deps) {
+    return {
+        enabled: (tenant) => deps.knowledgeEnabled(tenant),
+        async search(tenant, component, request) {
+            if (!(await deps.knowledgeEnabled(tenant))) {
+                throw new KnowledgeError('request', `knowledge is not enabled for this org/app/env; run: ${knowledgeEnableCommand(tenant)}`);
+            }
+            if (request.query.length < MIN_QUERY_CHARS || request.query.length > MAX_QUERY_CHARS) {
+                throw new KnowledgeError('request', `query must be between ${MIN_QUERY_CHARS} and ${MAX_QUERY_CHARS} characters`);
+            }
+            const limit = Math.min(MAX_RESULT_LIMIT, Math.max(MIN_RESULT_LIMIT, Math.floor(request.limit ?? DEFAULT_RESULT_LIMIT)));
+            const scope = { org: tenant.org, app: tenant.app, env: tenant.env };
+            const documents = await deps.hooks.searchDocuments(scope, component.name, {
+                query: request.query,
+                limit,
+            });
+            let sites = [];
+            const siteSearch = deps.siteSearchFor?.(tenant);
+            const wantsSites = component.sites.length > 0 && siteSearch !== undefined;
+            if (wantsSites && siteSearch !== undefined) {
+                if (deps.budget !== undefined) {
+                    const ceilings = await deps.budget.ceilings(tenant);
+                    const decision = await deps.budget.store.consume({ org: tenant.org, app: tenant.app }, 1, ceilings);
+                    // Blocked, never degraded: a mixed component must not quietly answer from documents.
+                    if (!decision.granted)
+                        throw new SearchBudgetExhaustedError(decision.state);
+                }
+                const collected = [];
+                for (const policy of component.sites) {
+                    const hits = await siteSearch.search({ origin: policy.origin, include: [...policy.include] }, { audience: 'public', revision: 'live' }, { query: request.query, limit });
+                    collected.push(...hits);
+                }
+                sites = collected;
+            }
+            return fuseHits(documents, sites, {
+                limit,
+                sitePolicies: component.sites.map((policy) => ({
+                    origin: policy.origin,
+                    include: [...policy.include],
+                })),
+            });
+        },
+    };
+}
+//# sourceMappingURL=executor.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAEhB,0BAA0B,GAI3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA2B,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAmC9E,MAAM,UAAU,6BAA6B,CAC3C,IAAiC;IAEjC,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAElD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,cAAc,CACtB,SAAS,EACT,uDAAuD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBACrF,MAAM,IAAI,cAAc,CACtB,SAAS,EACT,yBAAyB,eAAe,QAAQ,eAAe,aAAa,CAC7E,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,gBAAgB,EAChB,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAC9E,CAAC;YACF,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE;gBACxE,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;aACN,CAAC,CAAC;YAEH,IAAI,KAAK,GAAyB,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS,CAAC;YAC1E,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC9C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,CAAC,EACD,QAAQ,CACT,CAAC;oBACF,qFAAqF;oBACrF,IAAI,CAAC,QAAQ,CAAC,OAAO;wBAAE,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,SAAS,GAAgB,EAAE,CAAC;gBAClC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAClC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EACvD,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EACxC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAChC,CAAC;oBACF,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YAED,OAAO,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE;gBAChC,KAAK;gBACL,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;iBAC7B,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Noodle-side Google identities for the managed knowledge tier (ADR 0202 as amended): the
+ * Cloud Run runtime's ADC token impersonates the three least-privilege service accounts
+ * (provisioning is operator-only and never wired here; publication and search are). REST only —
+ * Apache packages never depend on `@google-cloud/*` — and tokens are cached until near expiry.
+ */
+import type { GoogleAccessTokenProvider } from '@noodle-borg/knowledge';
+/** The Cloud Run / GCE runtime identity via the metadata server (ADC). */
+export declare function metadataServiceTokenProvider(fetchImpl?: typeof fetch): GoogleAccessTokenProvider;
+/**
+ * Impersonate one least-privilege service account from a base identity that holds
+ * `roles/iam.serviceAccountTokenCreator` on it.
+ */
+export declare function impersonatedTokenProvider(base: GoogleAccessTokenProvider, serviceAccountEmail: string, fetchImpl?: typeof fetch): GoogleAccessTokenProvider;
+//# sourceMappingURL=google-identity.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-identity.d.ts","sourceRoot":"","sources":["../src/google-identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAYxE,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,KAAa,GAC9B,yBAAyB,CAgB3B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,yBAAyB,EAC/B,mBAAmB,EAAE,MAAM,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,yBAAyB,CA0B3B"}

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.js

@@ -0,0 +1,50 @@
+const METADATA_TOKEN_URL = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token';
+const IAM_CREDENTIALS_ROOT = 'https://iamcredentials.googleapis.com/v1';
+const EXPIRY_SKEW_MS = 5 * 60 * 1000;
+/** The Cloud Run / GCE runtime identity via the metadata server (ADC). */
+export function metadataServiceTokenProvider(fetchImpl = fetch) {
+    let cached;
+    return async () => {
+        if (cached !== undefined && Date.now() < cached.expiresAt - EXPIRY_SKEW_MS) {
+            return cached.token;
+        }
+        const response = await fetchImpl(METADATA_TOKEN_URL, {
+            headers: { 'Metadata-Flavor': 'Google' },
+        });
+        if (!response.ok) {
+            throw new Error(`metadata token request returned HTTP ${response.status}`);
+        }
+        const body = (await response.json());
+        cached = { token: body.access_token, expiresAt: Date.now() + body.expires_in * 1000 };
+        return cached.token;
+    };
+}
+/**
+ * Impersonate one least-privilege service account from a base identity that holds
+ * `roles/iam.serviceAccountTokenCreator` on it.
+ */
+export function impersonatedTokenProvider(base, serviceAccountEmail, fetchImpl = fetch) {
+    let cached;
+    return async () => {
+        if (cached !== undefined && Date.now() < cached.expiresAt - EXPIRY_SKEW_MS) {
+            return cached.token;
+        }
+        const baseToken = await base();
+        const response = await fetchImpl(`${IAM_CREDENTIALS_ROOT}/projects/-/serviceAccounts/${encodeURIComponent(serviceAccountEmail)}:generateAccessToken`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${baseToken}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ scope: ['https://www.googleapis.com/auth/cloud-platform'] }),
+        });
+        if (!response.ok) {
+            // Attributable without detail: the account and status only, never a response body.
+            throw new Error(`impersonation of ${serviceAccountEmail} returned HTTP ${response.status}`);
+        }
+        const body = (await response.json());
+        cached = { token: body.accessToken, expiresAt: Date.parse(body.expireTime) };
+        return cached.token;
+    };
+}
+//# sourceMappingURL=google-identity.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-identity.js","sourceRoot":"","sources":["../src/google-identity.ts"],"names":[],"mappings":"AAQA,MAAM,kBAAkB,GACtB,4FAA4F,CAAC;AAC/F,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAOrC,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAC1C,YAA0B,KAAK;IAE/B,IAAI,MAA+B,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;YACnD,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;QACrF,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAA+B,EAC/B,mBAA2B,EAC3B,YAA0B,KAAK;IAE/B,IAAI,MAA+B,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,oBAAoB,+BAA+B,kBAAkB,CAAC,mBAAmB,CAAC,sBAAsB,EACnH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,SAAS,EAAE;gBACpC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE,CAAC;SACpF,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,mFAAmF;YACnF,MAAM,IAAI,KAAK,CAAC,oBAAoB,mBAAmB,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgD,CAAC;QACpF,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/http.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Minimal HTTP plumbing for knowledge route handlers. Byte-compatible with the service's
+ * wire behavior but deliberately independent of it — a module package never imports the
+ * service (the feedback-operations precedent).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
+export declare function readBody(req: IncomingMessage, maxBytes: number): Promise<{
+    ok: true;
+    body: Buffer;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+}>;
+//# sourceMappingURL=http.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGjF;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpF"}

package/node_modules/@noodle-borg/knowledge-operations/dist/http.js

@@ -0,0 +1,18 @@
+export function sendJson(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+}
+export async function readBody(req, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > maxBytes) {
+            return { ok: false, status: 413, error: `request body exceeds ${maxBytes} bytes` };
+        }
+        chunks.push(buffer);
+    }
+    return { ok: true, body: Buffer.concat(chunks) };
+}
+//# sourceMappingURL=http.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC7E,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,QAAQ,QAAQ,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Knowledge control-plane orchestration (ADR 0202 as amended). The service composes these
+ * behind its thin dispatch; the CLI never imports this package.
+ */
+export { type StringSecretBox, secretBoxDocumentCodec } from './codec.js';
+export { dispatchKnowledgeRequest, type KnowledgeDispatchDeps } from './dispatch.js';
+export { createKnowledgeSearchExecutor, type KnowledgeSearchComponent, type KnowledgeSearchExecutor, type KnowledgeSearchExecutorDeps, type KnowledgeSearchRequest, } from './executor.js';
+export { impersonatedTokenProvider, metadataServiceTokenProvider, } from './google-identity.js';
+export { readBody, sendJson } from './http.js';
+export { type ManagedGoogleKnowledge, managedGoogleFromEnv, managedSiteProvisioned, managedSiteSearchFor, } from './managed-google.js';
+export { type KnowledgeRouteRef, parseKnowledgePath } from './paths.js';
+export { createKnowledgeDeployHooks, type KnowledgeDeployFailure, type KnowledgeDeployHooks, KnowledgePublicationError, type KnowledgePublicationPlan, withKnowledgePublication, } from './publication.js';
+export { handleKnowledgeDocumentUpload, handleKnowledgePreflight, type KnowledgeRouteDeps, type KnowledgeTenantRef, knowledgeEnableCommand, knowledgeTenantKey, } from './routes.js';
+export { type BoundKnowledgeSearchPort, bindKnowledgeSearchPort, type KnowledgeSearchPortFactory, knowledgeSearchPortFactory, } from './search-port.js';
+export { budgetCeilingsResolver, buildKnowledgeRouteDeps, createPostgresKnowledgeStores, defaultKnowledgeStores, type KnowledgeServiceStores, wireKnowledge, } from './service-wiring.js';
+export { InMemoryKnowledgeStagingStore, type KnowledgeStagingStore, PostgresKnowledgeStagingStore, STAGING_TTL_MS, } from './staging-store.js';
+export { handleKnowledgeList, handleKnowledgeStatus, type KnowledgeStatusDeps, } from './status-routes.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,6BAA6B,EAC7B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * Knowledge control-plane orchestration (ADR 0202 as amended). The service composes these
+ * behind its thin dispatch; the CLI never imports this package.
+ */
+export { secretBoxDocumentCodec } from './codec.js';
+export { dispatchKnowledgeRequest } from './dispatch.js';
+export { createKnowledgeSearchExecutor, } from './executor.js';
+export { impersonatedTokenProvider, metadataServiceTokenProvider, } from './google-identity.js';
+export { readBody, sendJson } from './http.js';
+export { managedGoogleFromEnv, managedSiteProvisioned, managedSiteSearchFor, } from './managed-google.js';
+export { parseKnowledgePath } from './paths.js';
+export { createKnowledgeDeployHooks, KnowledgePublicationError, withKnowledgePublication, } from './publication.js';
+export { handleKnowledgeDocumentUpload, handleKnowledgePreflight, knowledgeEnableCommand, knowledgeTenantKey, } from './routes.js';
+export { bindKnowledgeSearchPort, knowledgeSearchPortFactory, } from './search-port.js';
+export { budgetCeilingsResolver, buildKnowledgeRouteDeps, createPostgresKnowledgeStores, defaultKnowledgeStores, wireKnowledge, } from './service-wiring.js';
+export { InMemoryKnowledgeStagingStore, PostgresKnowledgeStagingStore, STAGING_TTL_MS, } from './staging-store.js';
+export { handleKnowledgeList, handleKnowledgeStatus, } from './status-routes.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAwB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAA8B,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,6BAA6B,GAK9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA0B,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,0BAA0B,EAG1B,yBAAyB,EAEzB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EAGxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,uBAAuB,EAEvB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EAEtB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAE7B,6BAA6B,EAC7B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,oBAAoB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Managed-bundled Google wiring (ADR 0202 as amended): resolve the Noodle-owned project and the
+ * two runtime-reachable identities (publication, search) from service environment, bind the
+ * sites-half adapter per tenant scope, and answer the honest site-provisioning question. The
+ * provisioning identity is deliberately unreachable from here — it exists only for the
+ * operator-run `scripts/knowledge-gcp-provision.mjs`.
+ */
+import { type GoogleAccessTokenProvider, type SiteSearch } from '@noodle-borg/knowledge';
+import type { KnowledgeTenantRef } from './routes.js';
+export interface ManagedGoogleKnowledge {
+    readonly project: string;
+    readonly location: string;
+    /** Reaches the deploy path only. */
+    readonly publicationTokens: GoogleAccessTokenProvider;
+    /** The only identity runtime execution may reach (ADR 0202 D9). */
+    readonly searchTokens: GoogleAccessTokenProvider;
+}
+/**
+ * Environment contract (set on the hosted service):
+ * `NOODLE_KNOWLEDGE_GCP_PROJECT` (required to enable the managed sites tier),
+ * `NOODLE_KNOWLEDGE_GCP_LOCATION` (default `global`),
+ * `NOODLE_KNOWLEDGE_PUBLICATION_SA` / `NOODLE_KNOWLEDGE_SEARCH_SA` (default the
+ * `knowledge-publication@` / `knowledge-search@` accounts in the project).
+ */
+export declare function managedGoogleFromEnv(env: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): ManagedGoogleKnowledge | undefined;
+export declare function managedSiteSearchFor(google: ManagedGoogleKnowledge, tenant: KnowledgeTenantRef): SiteSearch;
+/** Does the tenant's WEBSITE data store exist? Read with the search identity (viewer). */
+export declare function managedSiteProvisioned(google: ManagedGoogleKnowledge, tenant: KnowledgeTenantRef, fetchImpl?: typeof fetch): Promise<boolean>;
+//# sourceMappingURL=managed-google.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-google.d.ts","sourceRoot":"","sources":["../src/managed-google.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAEL,KAAK,yBAAyB,EAG9B,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;IACtD,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,GAAE,OAAO,KAAa,GAC9B,sBAAsB,GAAG,SAAS,CAgBpC;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,GACzB,UAAU,CAOZ;AAED,0FAA0F;AAC1F,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.js

@@ -0,0 +1,53 @@
+/**
+ * Managed-bundled Google wiring (ADR 0202 as amended): resolve the Noodle-owned project and the
+ * two runtime-reachable identities (publication, search) from service environment, bind the
+ * sites-half adapter per tenant scope, and answer the honest site-provisioning question. The
+ * provisioning identity is deliberately unreachable from here — it exists only for the
+ * operator-run `scripts/knowledge-gcp-provision.mjs`.
+ */
+import { GOOGLE_SITE_COMPONENT, GoogleAgentSearchSites, googleDataStoreId, } from '@noodle-borg/knowledge';
+import { impersonatedTokenProvider, metadataServiceTokenProvider } from './google-identity.js';
+/**
+ * Environment contract (set on the hosted service):
+ * `NOODLE_KNOWLEDGE_GCP_PROJECT` (required to enable the managed sites tier),
+ * `NOODLE_KNOWLEDGE_GCP_LOCATION` (default `global`),
+ * `NOODLE_KNOWLEDGE_PUBLICATION_SA` / `NOODLE_KNOWLEDGE_SEARCH_SA` (default the
+ * `knowledge-publication@` / `knowledge-search@` accounts in the project).
+ */
+export function managedGoogleFromEnv(env, fetchImpl = fetch) {
+    const project = env.NOODLE_KNOWLEDGE_GCP_PROJECT;
+    if (project === undefined || project === '')
+        return undefined;
+    const location = env.NOODLE_KNOWLEDGE_GCP_LOCATION ?? 'global';
+    const base = metadataServiceTokenProvider(fetchImpl);
+    const publication = env.NOODLE_KNOWLEDGE_PUBLICATION_SA ??
+        `knowledge-publication@${project}.iam.gserviceaccount.com`;
+    const search = env.NOODLE_KNOWLEDGE_SEARCH_SA ?? `knowledge-search@${project}.iam.gserviceaccount.com`;
+    return {
+        project,
+        location,
+        publicationTokens: impersonatedTokenProvider(base, publication, fetchImpl),
+        searchTokens: impersonatedTokenProvider(base, search, fetchImpl),
+    };
+}
+export function managedSiteSearchFor(google, tenant) {
+    return new GoogleAgentSearchSites({
+        project: google.project,
+        location: google.location,
+        tokenProvider: google.searchTokens,
+        scope: { org: tenant.org, app: tenant.app, env: tenant.env },
+    });
+}
+/** Does the tenant's WEBSITE data store exist? Read with the search identity (viewer). */
+export async function managedSiteProvisioned(google, tenant, fetchImpl = fetch) {
+    const id = googleDataStoreId({ org: tenant.org, app: tenant.app, env: tenant.env }, GOOGLE_SITE_COMPONENT);
+    const token = await google.searchTokens();
+    const response = await fetchImpl(`https://discoveryengine.googleapis.com/v1/projects/${google.project}/locations/${google.location}/collections/default_collection/dataStores/${id}`, { headers: { authorization: `Bearer ${token}` } });
+    if (response.status === 404)
+        return false;
+    if (!response.ok) {
+        throw new Error(`site datastore check for ${id} returned HTTP ${response.status}`);
+    }
+    return true;
+}
+//# sourceMappingURL=managed-google.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-google.js","sourceRoot":"","sources":["../src/managed-google.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAY/F;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAsB,EACtB,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,6BAA6B,IAAI,QAAQ,CAAC;IAC/D,MAAM,IAAI,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,GAAG,CAAC,+BAA+B;QACnC,yBAAyB,OAAO,0BAA0B,CAAC;IAC7D,MAAM,MAAM,GACV,GAAG,CAAC,0BAA0B,IAAI,oBAAoB,OAAO,0BAA0B,CAAC;IAC1F,OAAO;QACL,OAAO;QACP,QAAQ;QACR,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC;QAC1E,YAAY,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA8B,EAC9B,MAA0B;IAE1B,OAAO,IAAI,sBAAsB,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA8B,EAC9B,MAA0B,EAC1B,YAA0B,KAAK;IAE/B,MAAM,EAAE,GAAG,iBAAiB,CAC1B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACrD,qBAAqB,CACtB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,sDAAsD,MAAM,CAAC,OAAO,cAAc,MAAM,CAAC,QAAQ,8CAA8C,EAAE,EAAE,EACnJ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Knowledge route path parsing, owned here so the service keeps only a thin dispatch.
+ */
+import type { KnowledgeTenantRef } from './routes.js';
+export type KnowledgeRouteRef = {
+    readonly kind: 'preflight';
+    readonly tenant: KnowledgeTenantRef;
+} | {
+    readonly kind: 'document';
+    readonly tenant: KnowledgeTenantRef;
+    readonly sha256: string;
+} | {
+    readonly kind: 'list';
+    readonly tenant: KnowledgeTenantRef;
+} | {
+    readonly kind: 'status';
+    readonly tenant: KnowledgeTenantRef;
+    readonly component: string;
+};
+export declare function parseKnowledgePath(pathname: string): KnowledgeRouteRef | undefined;
+//# sourceMappingURL=paths.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAQjG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAkClF"}

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.js

@@ -0,0 +1,28 @@
+const PREFLIGHT = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/preflight$/;
+const DOCUMENT = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/documents\/([^/]+)$/;
+const LIST = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge$/;
+const STATUS = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/([^/]+)\/status$/;
+export function parseKnowledgePath(pathname) {
+    const preflight = PREFLIGHT.exec(pathname);
+    if (preflight !== null) {
+        const [, org, app, env] = preflight;
+        return { kind: 'preflight', tenant: { org, app, env } };
+    }
+    const list = LIST.exec(pathname);
+    if (list !== null) {
+        const [, org, app, env] = list;
+        return { kind: 'list', tenant: { org, app, env } };
+    }
+    const status = STATUS.exec(pathname);
+    if (status !== null) {
+        const [, org, app, env, component] = status;
+        return { kind: 'status', tenant: { org, app, env }, component };
+    }
+    const document = DOCUMENT.exec(pathname);
+    if (document !== null) {
+        const [, org, app, env, sha256] = document;
+        return { kind: 'document', tenant: { org, app, env }, sha256 };
+    }
+    return undefined;
+}
+//# sourceMappingURL=paths.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAWA,MAAM,SAAS,GAAG,2EAA2E,CAAC;AAC9F,MAAM,QAAQ,GACZ,oFAAoF,CAAC;AACvF,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAC9E,MAAM,MAAM,GAAG,iFAAiF,CAAC;AAEjG,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAwD,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAmD,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,MAMpC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,QAMjC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The deploy-coupled knowledge publication transaction (ADR 0202): lease → resolve bytes or
+ * reuse → stage (bundled index + revision + durable sealed text) → verify a positive filtered
+ * query → activate + pin, paired with the caller's artifact persistence. Any failure retains
+ * the previous artifact + revision pair; retry is idempotent by content hash.
+ */
+import { type CompiledKnowledgeComponent, type KnowledgeScope, type SearchHit, type SearchRequest } from '@noodle-borg/knowledge';
+import { type KnowledgeTenantRef } from './routes.js';
+import type { KnowledgeServiceStores } from './service-wiring.js';
+export interface KnowledgeDeployFailure {
+    readonly code: string;
+    readonly path: string;
+    readonly message: string;
+}
+/** Structured publication failure the registry maps onto its deploy error shape. */
+export declare class KnowledgePublicationError extends Error {
+    readonly errors: readonly KnowledgeDeployFailure[];
+    constructor(errors: readonly KnowledgeDeployFailure[]);
+}
+interface PlannedComponent {
+    readonly component: CompiledKnowledgeComponent;
+    readonly scope: KnowledgeScope;
+    readonly revisionId: string;
+    readonly previousRevisionId?: string;
+    readonly lease: {
+        readonly scopeKey: string;
+        readonly leaseId: string;
+    };
+}
+export interface KnowledgePublicationPlan {
+    readonly components: readonly PlannedComponent[];
+}
+export interface KnowledgeDeployHooks {
+    publish(tenant: KnowledgeTenantRef, deploymentId: string, components: readonly CompiledKnowledgeComponent[]): Promise<KnowledgePublicationPlan>;
+    activate(plan: KnowledgePublicationPlan, deploymentId: string): Promise<void>;
+    /** Re-activate the previous revisions after a persistence failure. */
+    compensate(plan: KnowledgePublicationPlan, deploymentId: string): Promise<void>;
+    /** Release leases; always runs, success or failure. */
+    finish(plan: KnowledgePublicationPlan): Promise<void>;
+    /** Reselect every revision the deployment pinned; the bundled index rebuilds lazily. */
+    rollback(deploymentId: string): Promise<void>;
+    /** Search the active document revision, rebuilding the bundled index when stale. */
+    searchDocuments(scope: KnowledgeScope, componentName: string, request: SearchRequest): Promise<readonly SearchHit[]>;
+    /** Throttled GC: expired staging entries and unreferenced revisions. */
+    sweep(): Promise<void>;
+}
+export declare function createKnowledgeDeployHooks(stores: KnowledgeServiceStores, options: {
+    readonly knowledgeEnabled: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    /** Managed site datastore existence; when bound, a site() deploy fails before activation. */
+    readonly siteProvisioned?: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    readonly now?: () => Date;
+}): KnowledgeDeployHooks;
+/**
+ * Wrap the caller's persistence step in the full publication transaction. The order is the
+ * ADR 0202 pairing: stage + verify + activate the revision, persist the artifact, and on a
+ * persistence failure re-activate the previous revision so the retained pair stays coherent.
+ */
+export declare function withKnowledgePublication<T>(hooks: KnowledgeDeployHooks | undefined, tenant: KnowledgeTenantRef, deploymentId: string, components: readonly CompiledKnowledgeComponent[] | undefined, persist: () => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=publication.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.d.ts","sourceRoot":"","sources":["../src/publication.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,0BAA0B,EAK/B,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAEnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oFAAoF;AACpF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAC;gBAEvC,MAAM,EAAE,SAAS,sBAAsB,EAAE;CAKtD;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CACL,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,0BAA0B,EAAE,GAChD,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,uDAAuD;IACvD,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,oFAAoF;IACpF,eAAe,CACb,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACjC,wEAAwE;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAOD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B,GACA,oBAAoB,CAyNtB;AAMD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,KAAK,EAAE,oBAAoB,GAAG,SAAS,EACvC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,EAC7D,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAgBZ"}