@noodleseed/one 0.121.0 → 0.123.0

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.js

@@ -0,0 +1,230 @@
+/**
+ * The deploy-coupled knowledge publication transaction (ADR 0202): lease → resolve bytes or
+ * reuse → stage (bundled index + revision + durable sealed text) → verify a positive filtered
+ * query → activate + pin, paired with the caller's artifact persistence. Any failure retains
+ * the previous artifact + revision pair; retry is idempotent by content hash.
+ */
+import { Bm25KnowledgeIndex, documentsContentHash, identityDocumentTextCodec, KnowledgeError, } from '@noodle-borg/knowledge';
+import { knowledgeEnableCommand, knowledgeTenantKey } from './routes.js';
+/** Structured publication failure the registry maps onto its deploy error shape. */
+export class KnowledgePublicationError extends Error {
+    errors;
+    constructor(errors) {
+        super(errors[0]?.message ?? 'knowledge publication failed');
+        this.name = 'KnowledgePublicationError';
+        this.errors = errors;
+    }
+}
+/** How long a cached active-revision check may serve before re-reading the durable store. */
+const ACTIVE_REVISION_TTL_MS = 5_000;
+/** Deploy-piggybacked GC cadence (the archive-sweeper pattern). */
+const SWEEP_INTERVAL_MS = 10 * 60 * 1000;
+export function createKnowledgeDeployHooks(stores, options) {
+    const index = new Bm25KnowledgeIndex();
+    const codec = stores.codec ?? identityDocumentTextCodec;
+    const now = options.now ?? (() => new Date());
+    const activeChecks = new Map();
+    let lastSweep = 0;
+    /** Staged text for a component, from durable revision text or transient staging. */
+    async function resolveDocuments(tenant, component, existingRevisionId) {
+        if (existingRevisionId !== undefined) {
+            try {
+                return [...(await stores.revisionStore.documents(existingRevisionId))];
+            }
+            catch {
+                // Reused revision without durable text (staged pre-migration or interrupted) — fall
+                // back to transient staging below.
+            }
+        }
+        const tenantKey = knowledgeTenantKey(tenant);
+        const documents = [];
+        for (const descriptor of component.documents) {
+            const sealed = await stores.staging.get(tenantKey, descriptor.sha256);
+            if (sealed === undefined) {
+                throw new KnowledgePublicationError([
+                    {
+                        code: 'knowledge_documents_missing',
+                        path: `knowledge.${component.name}.${descriptor.path}`,
+                        message: `knowledge document ${descriptor.path} has no staged bytes; ` +
+                            `run noodle deploy again to re-upload (retry is idempotent)`,
+                    },
+                ]);
+            }
+            documents.push({
+                descriptor: {
+                    path: descriptor.path,
+                    title: descriptor.title,
+                    ...(descriptor.sourceUrl !== undefined ? { sourceUrl: descriptor.sourceUrl } : {}),
+                    sha256: descriptor.sha256,
+                    bytes: descriptor.bytes,
+                },
+                text: (await codec.open(sealed)).toString('utf8'),
+            });
+        }
+        return documents;
+    }
+    /** Make sure the in-process index holds and activates the given revision. */
+    async function rebuildIndex(scope, componentName, revisionId) {
+        const current = await index.activeRevision(scope, componentName);
+        if (current?.revisionId === revisionId)
+            return;
+        const documents = await stores.revisionStore.documents(revisionId);
+        const staged = await index.stage(scope, componentName, documents);
+        if (staged.revisionId !== revisionId) {
+            throw new KnowledgeError('store', `rebuilt index revision ${staged.revisionId} does not match stored ${revisionId}`);
+        }
+        await index.activate(revisionId);
+    }
+    const hooks = {
+        async publish(tenant, deploymentId, components) {
+            const withDocuments = components.filter((component) => component.documents.length > 0);
+            if (components.length > 0 && !(await options.knowledgeEnabled(tenant))) {
+                throw new KnowledgePublicationError([
+                    {
+                        code: 'knowledge_not_enabled',
+                        path: 'knowledge',
+                        message: `knowledge is not enabled for this org/app/env; run: ${knowledgeEnableCommand(tenant)}`,
+                    },
+                ]);
+            }
+            const withSites = components.filter((component) => component.sites.length > 0);
+            if (withSites.length > 0 && options.siteProvisioned !== undefined) {
+                if (!(await options.siteProvisioned(tenant))) {
+                    throw new KnowledgePublicationError(withSites.map((component) => ({
+                        code: 'knowledge_site_not_provisioned',
+                        path: `knowledge.${component.name}`,
+                        message: `the managed site datastore for this tenant does not exist yet; an operator must ` +
+                            `run scripts/knowledge-gcp-provision.mjs --tenant ${tenant.org}/${tenant.app}/${tenant.env}, ` +
+                            `then check noodle knowledge status ${component.name}`,
+                    })));
+                }
+            }
+            const planned = [];
+            try {
+                for (const component of withDocuments) {
+                    const scope = { org: tenant.org, app: tenant.app, env: tenant.env };
+                    const lease = await stores.revisionStore.acquireLease(scope, component.name, deploymentId);
+                    const contentHash = documentsContentHash(component.documents.map((document) => document.sha256));
+                    const previous = await stores.revisionStore.active(scope, component.name);
+                    const reused = await stores.revisionStore.findByContentHash(scope, component.name, contentHash);
+                    const documents = await resolveDocuments(tenant, component, reused?.revisionId);
+                    const staged = await index.stage(scope, component.name, documents);
+                    const revision = reused ?? staged;
+                    await stores.revisionStore.stage({
+                        scope,
+                        componentName: component.name,
+                        contentHash,
+                        revision,
+                    });
+                    const verified = await index.verify(staged.revisionId, {
+                        audience: 'public',
+                        revision: staged.revisionId,
+                    });
+                    if (!verified) {
+                        throw new KnowledgePublicationError([
+                            {
+                                code: 'knowledge_verification_failed',
+                                path: `knowledge.${component.name}`,
+                                message: `knowledge component ${component.name} failed its positive filtered verification query`,
+                            },
+                        ]);
+                    }
+                    await stores.revisionStore.stageDocuments(revision.revisionId, documents);
+                    planned.push({
+                        component,
+                        scope,
+                        revisionId: revision.revisionId,
+                        ...(previous !== undefined ? { previousRevisionId: previous.revisionId } : {}),
+                        lease,
+                    });
+                }
+            }
+            catch (error) {
+                await hooks.finish({ components: planned });
+                throw error;
+            }
+            return { components: planned };
+        },
+        async activate(plan, deploymentId) {
+            for (const planned of plan.components) {
+                await stores.revisionStore.activate(planned.scope, planned.component.name, planned.revisionId, deploymentId);
+                await rebuildIndex(planned.scope, planned.component.name, planned.revisionId);
+                activeChecks.delete(knowledgeScopeCacheKey(planned.scope, planned.component.name));
+            }
+        },
+        async compensate(plan, deploymentId) {
+            for (const planned of plan.components) {
+                if (planned.previousRevisionId === undefined)
+                    continue;
+                // Pinning the previous revision to the failed deployment id is harmless: the record
+                // never persisted, and the pin only widens GC protection of the retained revision.
+                await stores.revisionStore.activate(planned.scope, planned.component.name, planned.previousRevisionId, deploymentId);
+                activeChecks.delete(knowledgeScopeCacheKey(planned.scope, planned.component.name));
+            }
+        },
+        async finish(plan) {
+            for (const planned of plan.components) {
+                await stores.revisionStore.releaseLease(planned.lease);
+            }
+        },
+        async rollback(deploymentId) {
+            const restored = await stores.revisionStore.rollback(deploymentId);
+            for (const revision of restored) {
+                activeChecks.delete(knowledgeScopeCacheKey(revision.scope, revision.componentName));
+            }
+        },
+        async searchDocuments(scope, componentName, request) {
+            const cacheKey = knowledgeScopeCacheKey(scope, componentName);
+            const cached = activeChecks.get(cacheKey);
+            let revisionId;
+            if (cached !== undefined && now().getTime() - cached.checkedAt <= ACTIVE_REVISION_TTL_MS) {
+                revisionId = cached.revisionId;
+            }
+            else {
+                revisionId = (await stores.revisionStore.active(scope, componentName))?.revisionId;
+                activeChecks.set(cacheKey, { revisionId, checkedAt: now().getTime() });
+            }
+            if (revisionId === undefined)
+                return [];
+            await rebuildIndex(scope, componentName, revisionId);
+            return index.search(scope, componentName, request);
+        },
+        async sweep() {
+            const at = now().getTime();
+            if (at - lastSweep < SWEEP_INTERVAL_MS)
+                return;
+            lastSweep = at;
+            await stores.staging.sweepExpired();
+            await stores.revisionStore.collectGarbage();
+        },
+    };
+    return hooks;
+}
+function knowledgeScopeCacheKey(scope, componentName) {
+    return `${scope.org}/${scope.app}/${scope.env}#${componentName}`;
+}
+/**
+ * Wrap the caller's persistence step in the full publication transaction. The order is the
+ * ADR 0202 pairing: stage + verify + activate the revision, persist the artifact, and on a
+ * persistence failure re-activate the previous revision so the retained pair stays coherent.
+ */
+export async function withKnowledgePublication(hooks, tenant, deploymentId, components, persist) {
+    if (hooks === undefined || components === undefined || components.length === 0) {
+        return persist();
+    }
+    const plan = await hooks.publish(tenant, deploymentId, components);
+    try {
+        await hooks.activate(plan, deploymentId);
+        const result = await persist();
+        void hooks.sweep().catch(() => undefined);
+        return result;
+    }
+    catch (error) {
+        await hooks.compensate(plan, deploymentId).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        await hooks.finish(plan);
+    }
+}
+//# sourceMappingURL=publication.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.js","sourceRoot":"","sources":["../src/publication.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,kBAAkB,EAElB,oBAAoB,EACpB,yBAAyB,EACzB,cAAc,GAMf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA2B,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AASlG,oFAAoF;AACpF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,MAAM,CAAoC;IAEnD,YAAY,MAAyC;QACnD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,8BAA8B,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAqCD,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,UAAU,0BAA0B,CACxC,MAA8B,EAC9B,OAKC;IAED,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,yBAAyB,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiE,CAAC;IAC9F,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,oFAAoF;IACpF,KAAK,UAAU,gBAAgB,CAC7B,MAA0B,EAC1B,SAAqC,EACrC,kBAA2B;QAE3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,oFAAoF;gBACpF,mCAAmC;YACrC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAqB,EAAE,CAAC;QACvC,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,yBAAyB,CAAC;oBAClC;wBACE,IAAI,EAAE,6BAA6B;wBACnC,IAAI,EAAE,aAAa,SAAS,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE;wBACtD,OAAO,EACL,sBAAsB,UAAU,CAAC,IAAI,wBAAwB;4BAC7D,4DAA4D;qBAC/D;iBACF,CAAC,CAAC;YACL,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB;gBACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,KAAK,UAAU,YAAY,CACzB,KAAqB,EACrB,aAAqB,EACrB,UAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU;YAAE,OAAO;QAC/C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,cAAc,CACtB,OAAO,EACP,0BAA0B,MAAM,CAAC,UAAU,0BAA0B,UAAU,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAyB;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU;YAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,yBAAyB,CAAC;oBAClC;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,uDAAuD,sBAAsB,CAAC,MAAM,CAAC,EAAE;qBACjG;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,yBAAyB,CACjC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC5B,IAAI,EAAE,gCAAgC;wBACtC,IAAI,EAAE,aAAa,SAAS,CAAC,IAAI,EAAE;wBACnC,OAAO,EACL,kFAAkF;4BAClF,oDAAoD,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI;4BAC9F,sCAAsC,SAAS,CAAC,IAAI,EAAE;qBACzD,CAAC,CAAC,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;oBACpF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CACnD,KAAK,EACL,SAAS,CAAC,IAAI,EACd,YAAY,CACb,CAAC;oBACF,MAAM,WAAW,GAAG,oBAAoB,CACtC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvD,CAAC;oBACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,iBAAiB,CACzD,KAAK,EACL,SAAS,CAAC,IAAI,EACd,WAAW,CACZ,CAAC;oBACF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;oBAChF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACnE,MAAM,QAAQ,GAAsB,MAAM,IAAI,MAAM,CAAC;oBACrD,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;wBAC/B,KAAK;wBACL,aAAa,EAAE,SAAS,CAAC,IAAI;wBAC7B,WAAW;wBACX,QAAQ;qBACT,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;wBACrD,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,MAAM,CAAC,UAAU;qBAC5B,CAAC,CAAC;oBACH,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,IAAI,yBAAyB,CAAC;4BAClC;gCACE,IAAI,EAAE,+BAA+B;gCACrC,IAAI,EAAE,aAAa,SAAS,CAAC,IAAI,EAAE;gCACnC,OAAO,EAAE,uBAAuB,SAAS,CAAC,IAAI,kDAAkD;6BACjG;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAC1E,OAAO,CAAC,IAAI,CAAC;wBACX,SAAS;wBACT,KAAK;wBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9E,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY;YAC/B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,SAAS,CAAC,IAAI,EACtB,OAAO,CAAC,UAAU,EAClB,YAAY,CACb,CAAC;gBACF,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC9E,YAAY,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY;YACjC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;oBAAE,SAAS;gBACvD,oFAAoF;gBACpF,mFAAmF;gBACnF,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,SAAS,CAAC,IAAI,EACtB,OAAO,CAAC,kBAAkB,EAC1B,YAAY,CACb,CAAC;gBACF,YAAY,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACnE,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,YAAY,CAAC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO;YACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,UAA8B,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBACzF,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC;gBACnF,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACxC,MAAM,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,EAAE,GAAG,SAAS,GAAG,iBAAiB;gBAAE,OAAO;YAC/C,SAAS,GAAG,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAqB,EAAE,aAAqB;IAC1E,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAuC,EACvC,MAA0B,EAC1B,YAAoB,EACpB,UAA6D,EAC7D,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;QAC/B,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/routes.d.ts

@@ -0,0 +1,38 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type DocumentTextCodec, type KnowledgeScope } from '@noodle-borg/knowledge';
+import type { KnowledgeStagingStore } from './staging-store.js';
+export interface KnowledgeTenantRef {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}
+export interface KnowledgeRouteDeps {
+    readonly staging: KnowledgeStagingStore;
+    /** Managed-config feature gate (`NOODLE_KNOWLEDGE_ENABLED`), resolved org → app → env. */
+    readonly knowledgeEnabled: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    /** Whole-set content-hash reuse: an unchanged component needs no uploads at all. */
+    readonly findRevisionByContentHash: (scope: KnowledgeScope, componentName: string, contentHash: string) => Promise<{
+        readonly revisionId: string;
+    } | undefined>;
+    readonly maxBodyBytes: number;
+    /** Seals staged bytes at rest; the service injects its secret-box codec. */
+    readonly codec?: DocumentTextCodec;
+    /** Operator read surface (list/status); wired by `wireKnowledge`, absent in bare handlers. */
+    readonly status?: import('./status-routes.js').KnowledgeStatusDeps;
+}
+export declare function knowledgeTenantKey(tenant: KnowledgeTenantRef): string;
+/** The one command that turns the feature on for a tenant; every fail-closed error names it. */
+export declare function knowledgeEnableCommand(tenant: KnowledgeTenantRef): string;
+/**
+ * `POST /v1/orgs/{o}/apps/{a}/envs/{e}/knowledge/preflight` — diff declared document hashes
+ * against transient staging and published revisions; respond with exactly the hashes that
+ * still need bytes. Descriptors only; no contents cross this route.
+ */
+export declare function handleKnowledgePreflight(req: IncomingMessage, res: ServerResponse, tenant: KnowledgeTenantRef, deps: KnowledgeRouteDeps): Promise<void>;
+/**
+ * `PUT /v1/orgs/{o}/apps/{a}/envs/{e}/knowledge/documents/{sha256}` — raw UTF-8 bytes,
+ * verified against the addressed hash before sealing into transient staging (ADR 0202 D5:
+ * the service verifies declared length and hash before publication).
+ */
+export declare function handleKnowledgeDocumentUpload(req: IncomingMessage, res: ServerResponse, tenant: KnowledgeTenantRef, sha256: string, deps: KnowledgeRouteDeps): Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EACL,KAAK,iBAAiB,EAGtB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,0FAA0F;IAC1F,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,oFAAoF;IACpF,QAAQ,CAAC,yBAAyB,EAAE,CAClC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,oBAAoB,EAAE,mBAAmB,CAAC;CACpE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAKzE;AAYD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/node_modules/@noodle-borg/knowledge-operations/dist/routes.js

@@ -0,0 +1,100 @@
+/**
+ * Knowledge control-plane route handlers (ADR 0202 as amended). The service dispatch
+ * authorizes the request and parses the tenant path, then delegates here; these handlers own
+ * validation, the feature gate, staging, and wire shapes — never auth.
+ */
+import { createHash } from 'node:crypto';
+import { documentsContentHash, identityDocumentTextCodec, } from '@noodle-borg/knowledge';
+import { MAX_DOCUMENT_BYTES } from '@noodle-borg/knowledge/limits';
+import { knowledgePreflightRequestSchema, } from '@noodle-borg/wire-contracts';
+import { readBody, sendJson } from './http.js';
+export function knowledgeTenantKey(tenant) {
+    return `${tenant.org}/${tenant.app}/${tenant.env}`;
+}
+/** The one command that turns the feature on for a tenant; every fail-closed error names it. */
+export function knowledgeEnableCommand(tenant) {
+    return (`noodle variables set NOODLE_KNOWLEDGE_ENABLED --value true --runtime cloud ` +
+        `--scope env --org ${tenant.org} --app ${tenant.app} --env ${tenant.env}`);
+}
+function sendGateClosed(res, tenant) {
+    sendJson(res, 403, {
+        code: 'knowledge_not_enabled',
+        error: 'knowledge is not enabled for this org/app/env',
+        fix: knowledgeEnableCommand(tenant),
+    });
+}
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * `POST /v1/orgs/{o}/apps/{a}/envs/{e}/knowledge/preflight` — diff declared document hashes
+ * against transient staging and published revisions; respond with exactly the hashes that
+ * still need bytes. Descriptors only; no contents cross this route.
+ */
+export async function handleKnowledgePreflight(req, res, tenant, deps) {
+    if (!(await deps.knowledgeEnabled(tenant)))
+        return sendGateClosed(res, tenant);
+    const body = await readBody(req, deps.maxBodyBytes);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    let request;
+    try {
+        const parsed = knowledgePreflightRequestSchema.safeParse(JSON.parse(body.body.toString('utf8')));
+        if (!parsed.success)
+            throw new Error(parsed.error.issues[0]?.message ?? 'invalid request');
+        request = parsed.data;
+    }
+    catch (error) {
+        return sendJson(res, 400, {
+            code: 'invalid_knowledge_request',
+            error: `invalid knowledge preflight request: ${error.message}`,
+        });
+    }
+    const tenantKey = knowledgeTenantKey(tenant);
+    const scope = { org: tenant.org, app: tenant.app, env: tenant.env };
+    const missing = [];
+    const seen = new Set();
+    for (const component of request.components) {
+        const hashes = component.documents.map((document) => document.sha256);
+        const published = await deps.findRevisionByContentHash(scope, component.name, documentsContentHash(hashes));
+        if (published !== undefined)
+            continue;
+        for (const sha256 of hashes) {
+            if (seen.has(sha256))
+                continue;
+            seen.add(sha256);
+            if (!(await deps.staging.has(tenantKey, sha256)))
+                missing.push(sha256);
+        }
+    }
+    const response = { ok: true, missing };
+    return sendJson(res, 200, response);
+}
+/**
+ * `PUT /v1/orgs/{o}/apps/{a}/envs/{e}/knowledge/documents/{sha256}` — raw UTF-8 bytes,
+ * verified against the addressed hash before sealing into transient staging (ADR 0202 D5:
+ * the service verifies declared length and hash before publication).
+ */
+export async function handleKnowledgeDocumentUpload(req, res, tenant, sha256, deps) {
+    if (!(await deps.knowledgeEnabled(tenant)))
+        return sendGateClosed(res, tenant);
+    if (!SHA256_HEX.test(sha256)) {
+        return sendJson(res, 400, {
+            code: 'invalid_knowledge_request',
+            error: 'document address must be a lowercase hex sha256',
+        });
+    }
+    const body = await readBody(req, Math.min(deps.maxBodyBytes, MAX_DOCUMENT_BYTES));
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const actual = createHash('sha256').update(body.body).digest('hex');
+    if (actual !== sha256) {
+        return sendJson(res, 400, {
+            code: 'knowledge_document_hash_mismatch',
+            error: 'uploaded bytes do not match the addressed content hash',
+        });
+    }
+    const codec = deps.codec ?? identityDocumentTextCodec;
+    await deps.staging.put(knowledgeTenantKey(tenant), sha256, await codec.seal(body.body), body.body.length);
+    const response = { ok: true, sha256 };
+    return sendJson(res, 200, response);
+}
+//# sourceMappingURL=routes.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAGL,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA0B/C,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,OAAO,CACL,6EAA6E;QAC7E,qBAAqB,MAAM,CAAC,GAAG,UAAU,MAAM,CAAC,GAAG,UAAU,MAAM,CAAC,GAAG,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB,EAAE,MAA0B;IACrE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,+CAA+C;QACtD,GAAG,EAAE,sBAAsB,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAoB,EACpB,GAAmB,EACnB,MAA0B,EAC1B,IAAwB;IAExB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,OAAiE,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;QAC3F,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,wCAAyC,KAAe,CAAC,OAAO,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IACpF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACpD,KAAK,EACL,SAAS,CAAC,IAAI,EACd,oBAAoB,CAAC,MAAM,CAAC,CAC7B,CAAC;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAA+B,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACnE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,GAAmB,EACnB,MAA0B,EAC1B,MAAc,EACd,IAAwB;IAExB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,iDAAiD;SACzD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,IAAI,EAAE,kCAAkC;YACxC,KAAK,EAAE,wDAAwD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC;IACtD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,kBAAkB,CAAC,MAAM,CAAC,EAC1B,MAAM,EACN,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CACjB,CAAC;IACF,MAAM,QAAQ,GAA4B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/search-port.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Adapts the knowledge search executor to the runtime's deployment-bound port shape
+ * (structurally typed against `@noodle-borg/runtime`'s `KnowledgeSearchPort`): tenant and
+ * component set are bound once per deployment; failures become typed refusals, never partial
+ * answers, and no provider detail crosses the port.
+ */
+import { type SearchHit } from '@noodle-borg/knowledge';
+import type { KnowledgeSearchComponent, KnowledgeSearchExecutor } from './executor.js';
+import type { KnowledgeTenantRef } from './routes.js';
+export interface BoundKnowledgeSearchPort {
+    enabled(): Promise<boolean>;
+    search(componentName: string, request: {
+        readonly query: string;
+        readonly limit?: number;
+    }): Promise<{
+        readonly ok: true;
+        readonly hits: readonly SearchHit[];
+    } | {
+        readonly ok: false;
+        readonly reason: 'budget_exhausted' | 'not_enabled' | 'provider_error';
+        readonly message: string;
+    }>;
+}
+export type KnowledgeSearchPortFactory = (tenant: {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}, components: readonly KnowledgeSearchComponent[]) => BoundKnowledgeSearchPort;
+export declare function knowledgeSearchPortFactory(executor: KnowledgeSearchExecutor): KnowledgeSearchPortFactory;
+export declare function bindKnowledgeSearchPort(executor: KnowledgeSearchExecutor, tenant: KnowledgeTenantRef, components: readonly KnowledgeSearchComponent[]): BoundKnowledgeSearchPort;
+//# sourceMappingURL=search-port.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/search-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-port.d.ts","sourceRoot":"","sources":["../src/search-port.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA8C,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CACJ,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CACN;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,CAAA;KAAE,GAC1D;QACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QACnB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa,GAAG,gBAAgB,CAAC;QACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CACJ,CAAC;CACH;AAED,MAAM,MAAM,0BAA0B,GAAG,CACvC,MAAM,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC5E,UAAU,EAAE,SAAS,wBAAwB,EAAE,KAC5C,wBAAwB,CAAC;AAE9B,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAChC,0BAA0B,CAE5B;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,kBAAkB,EAC1B,UAAU,EAAE,SAAS,wBAAwB,EAAE,GAC9C,wBAAwB,CAuB1B"}

package/node_modules/@noodle-borg/knowledge-operations/dist/search-port.js

@@ -0,0 +1,36 @@
+/**
+ * Adapts the knowledge search executor to the runtime's deployment-bound port shape
+ * (structurally typed against `@noodle-borg/runtime`'s `KnowledgeSearchPort`): tenant and
+ * component set are bound once per deployment; failures become typed refusals, never partial
+ * answers, and no provider detail crosses the port.
+ */
+import { KnowledgeError, SearchBudgetExhaustedError } from '@noodle-borg/knowledge';
+export function knowledgeSearchPortFactory(executor) {
+    return (tenant, components) => bindKnowledgeSearchPort(executor, tenant, components);
+}
+export function bindKnowledgeSearchPort(executor, tenant, components) {
+    return {
+        enabled: () => executor.enabled(tenant),
+        async search(componentName, request) {
+            const component = components.find((candidate) => candidate.name === componentName);
+            if (component === undefined) {
+                return { ok: false, reason: 'provider_error', message: 'unknown knowledge component' };
+            }
+            try {
+                const hits = await executor.search(tenant, component, request);
+                return { ok: true, hits };
+            }
+            catch (error) {
+                if (error instanceof SearchBudgetExhaustedError) {
+                    return { ok: false, reason: 'budget_exhausted', message: error.message };
+                }
+                if (error instanceof KnowledgeError) {
+                    const reason = error.layer === 'request' ? 'not_enabled' : 'provider_error';
+                    return { ok: false, reason, message: error.message };
+                }
+                return { ok: false, reason: 'provider_error', message: 'knowledge search failed' };
+            }
+        },
+    };
+}
+//# sourceMappingURL=search-port.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/search-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-port.js","sourceRoot":"","sources":["../src/search-port.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAkB,MAAM,wBAAwB,CAAC;AAwBpG,MAAM,UAAU,0BAA0B,CACxC,QAAiC;IAEjC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAiC,EACjC,MAA0B,EAC1B,UAA+C;IAE/C,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO;YACjC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;YACnF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;YACzF,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC3E,CAAC;gBACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC;oBAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBACvD,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/service-wiring.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Composition helpers the service calls from its (size-pinned) bootstrap files, so the thin
+ * dispatch stays thin: store construction, schema setup, and route-deps assembly live here.
+ */
+import { type CompiledKnowledgeComponent, type DocumentTextCodec, type KnowledgeRevisionStore, type SearchBudgetCeilings, type SearchBudgetStore } from '@noodle-borg/knowledge';
+import type { Pool } from 'pg';
+import { type StringSecretBox } from './codec.js';
+import { type KnowledgeSearchExecutor } from './executor.js';
+import { type ManagedGoogleKnowledge } from './managed-google.js';
+import { type KnowledgeDeployHooks } from './publication.js';
+import type { KnowledgeRouteDeps, KnowledgeTenantRef } from './routes.js';
+import { type KnowledgeSearchPortFactory } from './search-port.js';
+import { type KnowledgeStagingStore } from './staging-store.js';
+export interface KnowledgeServiceStores {
+    readonly staging: KnowledgeStagingStore;
+    readonly revisionStore: KnowledgeRevisionStore;
+    readonly codec?: DocumentTextCodec;
+    /** Org-pooled monthly site-search spend control (per-app sub-caps). */
+    readonly budgetStore?: SearchBudgetStore;
+    /** Managed Noodle-owned Google project; absent means the sites tier is dark. */
+    readonly google?: ManagedGoogleKnowledge;
+}
+/** In-memory stores with the identity codec — the no-persistence service default. */
+export declare function defaultKnowledgeStores(): KnowledgeServiceStores;
+/** Durable stores sharing the service's Postgres pool and secret-box custody. */
+export declare function createPostgresKnowledgeStores(pool: Pool, secretBox?: StringSecretBox, env?: NodeJS.ProcessEnv): Promise<KnowledgeServiceStores>;
+/** Budget ceilings from managed config with the ratified v0 defaults (2000 org / 1000 app). */
+export declare function budgetCeilingsResolver(resolveVariables: (tenant: KnowledgeTenantRef) => Promise<Record<string, string>>): (tenant: KnowledgeTenantRef) => Promise<SearchBudgetCeilings>;
+/** Assemble route deps over the service's managed-config resolver (`NOODLE_KNOWLEDGE_ENABLED`). */
+export declare function buildKnowledgeRouteDeps(stores: KnowledgeServiceStores, resolveVariables: (tenant: KnowledgeTenantRef) => Promise<Record<string, string>>, maxBodyBytes: number): KnowledgeRouteDeps;
+/**
+ * One-call composition for the service: resolve stores, build route deps, and register the
+ * deploy-coupled publication hooks on the registry (structurally typed; no service import).
+ */
+export declare function wireKnowledge(registry: {
+    setKnowledgeDeployHooks(hooks: KnowledgeDeployHooks, search?: KnowledgeSearchPortFactory): void;
+    getActiveByTenant(ref: {
+        org: string;
+        app: string;
+        env: string;
+    }): Promise<{
+        readonly served: {
+            readonly artifact: {
+                readonly server: ActiveServerKnowledge;
+            };
+        };
+    } | undefined>;
+}, stores: KnowledgeServiceStores | undefined, resolveVariables: (tenant: KnowledgeTenantRef) => Promise<Record<string, string>>, maxBodyBytes: number): KnowledgeRouteDeps & {
+    readonly executor: KnowledgeSearchExecutor;
+};
+interface ActiveServerKnowledge {
+    readonly knowledge?: readonly CompiledKnowledgeComponent[] | undefined;
+    readonly deploymentId?: string | undefined;
+}
+export {};
+//# sourceMappingURL=service-wiring.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/service-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-wiring.d.ts","sourceRoot":"","sources":["../src/service-wiring.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EAGtB,KAAK,sBAAsB,EAG3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,KAAK,eAAe,EAA0B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAiC,KAAK,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,KAAK,0BAA0B,EAA8B,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,IAAI,sBAAsB,CAM/D;AAED,iFAAiF;AACjF,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,IAAI,EACV,SAAS,CAAC,EAAE,eAAe,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAgBjC;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAChF,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAU/D;AAED,mGAAmG;AACnG,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,sBAAsB,EAC9B,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjF,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAUpB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE;IACR,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAChG,iBAAiB,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CACP;QAAE,QAAQ,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE;gBAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,GACtF,SAAS,CACZ,CAAC;CACH,EACD,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjF,YAAY,EAAE,MAAM,GACnB,kBAAkB,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAA;CAAE,CAmErE;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C"}